ELSA-2026-500395

Опубликовано: 15 окт. 2026

Источник: oracle-oval

Платформа: Oracle Linux 8

Платформа: Oracle Linux 9

Описание

ELSA-2026-500395: Unbreakable Enterprise kernel security update (IMPORTANT)

[5.15.0-325.221.6.3]

exec: Cleanup POSIX timers right after de_thread() (Hyunwoo Kim) [Orabug: 40157515] {CVE-2026-98260}

[5.15.0-325.221.6.2]

eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner) [Orabug: 39784995] {CVE-2026-46242}
eventpoll: move epi_fget() up (Christian Brauner) [Orabug: 39784995]
eventpoll: rename ep_remove_safe() back to ep_remove() (Christian Brauner) [Orabug: 39784995]
eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Christian Brauner) [Orabug: 39784995]
eventpoll: kill __ep_remove() (Christian Brauner) [Orabug: 39784995]
eventpoll: split __ep_remove() (Christian Brauner) [Orabug: 39784995]
eventpoll: use hlist_is_singular_node() in __ep_remove() (Christian Brauner) [Orabug: 39784995]
eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 39784995]
file: add fput() cleanup helper (Christian Brauner) [Orabug: 39784995]
landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation (Gunther Noack) [Orabug: 40021203] {CVE-2026-89560}
ppp_synctty: ensure a writeable skb header (Qingfang Deng) [Orabug: 40079220] {CVE-2026-97964}
netfilter: nfnetlink_log: cope with concurrent instance destruction (Florian Westphal) [Orabug: 40079360] {CVE-2026-97998}
vxlan: reject dynamic fdb entries that reference a nexthop id (Seungwon Bae) [Orabug: 40079448] {CVE-2026-98023}
ipvs: fix reversed sequence option serialization (Kyle Zeng) [Orabug: 40079626] {CVE-2026-98078}
ipv6: sr: restore network header before routing and forwarding (Eric Dumazet) [Orabug: 40079700] {CVE-2026-98096}
hsr: broadcast netlink notifications in the device's net namespace (Maoyi Xie) [Orabug: 40073495] {CVE-2026-97419}
fs/ntfs3: validate index entry key bounds (ZhengYuan Huang) [Orabug: 40073603] {CVE-2026-97438}

[5.15.0-325.221.6.1]

x86/kexec: Add EFI config table identity mapping for kexec kernel (Tao Liu) [Orabug: 40127851]
KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (Sean Christopherson) [Orabug: 40127747] {CVE-2026-80726}

[5.15.0-325.221.6]

scsi: qla2xxx: Preserve PURLS head on reject (Vijayendra Suman) [Orabug: 40088703]
net: Account VLAN RPS drops (Vijayendra Suman) [Orabug: 40088694]
net: tun: set drop reason for truncated raw TUN packets (Vijayendra Suman) [Orabug: 40088685]
IB/mlx4: delete allocated id_map_entry while sending REJ (Praveen Kumar Kannoju) [Orabug: 40002252]
scsi: target: iblock: Allow iblock devices to be shared (Mike Christie) [Orabug: 39226785]
scsi: target: core: Fix complete_type use (Mike Christie) [Orabug: 39226785]
scsi: vhost-scsi: Report direction completion support (Mike Christie) [Orabug: 39226785]
scsi: target: Allow userspace to set the completion type (Mike Christie) [Orabug: 39226785]
scsi: target: Use driver completion preference by default (Mike Christie) [Orabug: 39226785]
scsi: target: Add support for completing commands from backend context (Mike Christie) [Orabug: 39226785]
scsi: target: Move LUN stats to per-CPU (Mike Christie) [Orabug: 39226785]
scsi: target: Create and use macro helpers for per-CPU stats (Mike Christie) [Orabug: 39226785]
scsi: target: Fix LUN/device R/W and total command stats (Mike Christie) [Orabug: 39226785]
scsi: target: Move delayed/ordered tracking to per CPU (Mike Christie) [Orabug: 39226785]
scsi: target: Fix ordered CMD_T_SENT handling (Mike Christie) [Orabug: 39226785]
scsi: target: Move I/O path stats to per CPU (Mike Christie) [Orabug: 39226785]
KVM: x86: Reset last_steal on vCPU pid change (Dongli Zhang) [Orabug: 39592756]
bpftool: remove duplicate free_btf_vmlinux() definition (Suraj Jitindar Singh) [Orabug: 40083890]
Revert 'bpftool: Update btf_dump__new() and perf_buffer__new_raw() calls' (Vijayendra Suman) [Orabug: 40084576]
LTS version: v5.15.221 (Vijayendra Suman)
clk: qcom: gdsc: Bump parent usage count when GDSC is found enabled (Bjorn Andersson)
nvmet-rdma: fix queue leak when connect backlog is exceeded (Xixin Liu) [Orabug: 40109663] {CVE-2026-98152}
kselftest/arm64: mte: Use the correct naming for tag check modes in check_hugetlb_options.c (Catalin Marinas)
kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such mappings (Catalin Marinas)
Bluetooth: L2CAP: Fix send LE flow credits in ACL link (Zhang Chen)
ALSA: control: Fix unannotated kfree() cleanup (Takashi Iwai)
HID: fix an error code in hid_check_device_match() (Dan Carpenter)
clk: qcom: Drop mmcx gdsc supply for dispcc and videocc (Abel Vesa)
nvme: target: rdma: fix ndev refcount leak on queue connect (Xu Wang) [Orabug: 40109645] {CVE-2026-64321}
net/sched: sch_htb: limit htb_classify inner-class filter hops (Jamal Hadi Salim) [Orabug: 40041294] {CVE-2026-90053}
tcp: fix corruption of urgent data on multi-segment retransmit (Jiayuan Chen) [Orabug: 40041302] {CVE-2026-90054}
usb: atm: usbatm: fix invalid ci_range initialization (Deepanshu Kartikey) [Orabug: 40041309] {CVE-2026-90055}
net: fec: only stop PTP if it was initialized (Bui Duc Phuc)
net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup (Jamal Hadi Salim) [Orabug: 40041332] {CVE-2026-90058}
net: stmmac: selftests: Account for the UC filter list for filtering tests (Maxime Chevallier)
net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering (Maxime Chevallier)
net: stmmac: dwmac4: Account for the primary MAC address for UC filtering (Maxime Chevallier)
net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering (Maxime Chevallier)
net: stmmac: selftests: Check multiple MMC counters (Maxime Chevallier)
selftests/arm64: Treat KSM merge_across_nodes as optional (Usama Anjum)
selftests/arm64: Print missing MTE TAP headers (Usama Anjum)
selftests: arm64: add hugetlb mte tests (Yang Shi) [Orabug: 38006900,38177800]
netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited() (Pablo Neira Ayuso)
netfilter: xt_HL: add pr_fmt and checkentry validation (Marino Dzalto)
netfilter: xt_cgroup: Make it independent from net_cls (Michal Koutny)
netfilter: nf_tables: move hardware offload step after building the chain blob (Pablo Neira Ayuso) [Orabug: 40041352] {CVE-2026-90062}
net: stmmac: selftests: Pass the IP proto mask in the TC selftest (Maxime Chevallier)
net: ethernet: sun4i-emac: Fix IRQ error handling (Bui Duc Phuc)
libceph: validate banner payload length (Aleksandr Nogikh) [Orabug: 40041367] {CVE-2026-90067}
ASoC: dapm: Fix off-by-one check on the second enum channel (Hyeongjun An) [Orabug: 40041370] {CVE-2026-90068}
apparmor: policy_int make sure list heads are initialized before fail path (John Johansen)
apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init (Thorsten Blum)
tpm: st33zp24: Validate locality read result (Ruoyu Wang)
tpm: st33zp24: Return zero on status read failure (Ruoyu Wang) [Orabug: 40041376] {CVE-2026-90070}
net/sched: sch_teql: restore skb->dev on the slave failure path (Victor Nogueira) [Orabug: 40043380] {CVE-2026-90071}
net/sched: sfq: clamp quantum to avoid signed overflow soft lockup (Jamal Hadi Salim) [Orabug: 40041382] {CVE-2026-90072}
net/sched: hhf: clamp quantum before hhf_change() to avoid overflow (Jamal Hadi Salim) [Orabug: 40041386] {CVE-2026-90073}
net/sched: fq_pie: clamp default quantum to avoid signed overflow (Jamal Hadi Salim)
net/sched: sch_codel: clamp default mtu to avoid disabling CoDel (Jamal Hadi Salim)
net/sched: fq_codel: clamp default quantum and mtu (Jamal Hadi Salim) [Orabug: 40041393] {CVE-2026-90075}
net_sched: export pfifo_fast prio2band[] (Eric Dumazet)
net_sched: sch_fq: change how @inactive is tracked (Eric Dumazet)
net_sched: sch_fq: struct sched_data reorg (Eric Dumazet)
net: ip6_gre: Remove the unused function ip6gre_tnl_addr_conflict() (Jiapeng Chong)
net/sched: act_skbmod: fix length calculations and avoid invalid header warnings (Eric Dumazet) [Orabug: 40041404] {CVE-2026-90078}
cifs: fix clearing stats for fastest execution of each smb2 command (Frank Sorenson)
octeontx2-af: Fix TL3/TL2 link config ENA clearing (Naveen Mamindlapalli)
net: qualcomm: rmnet: restore skb->dev on deaggregated frames (Xiang Mei)
gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (Cen Zhang) [Orabug: 40033100] {CVE-2026-89789}
Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (Hyunwoo Kim) [Orabug: 40041441] {CVE-2026-90088}
Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (Chris Lu)
scsi: qla2xxx: Fix an loop timeout test (Dan Carpenter)
NFSv4/pnfs: key the data server cache on the NFS version (Junrui Luo) [Orabug: 40041480] {CVE-2026-90102}
nfs: move the nfs4_data_server_cache into struct nfs_net (Jeff Layton)
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion (Junrui Luo) [Orabug: 40041487] {CVE-2026-90103}
net/smc: free pending qentry in smc_llc_flow_stop() before memset (Mahanta Jambigi)
net: ipa: balance runtime PM reference on remove error (Ruoyu Wang)
net: ipa: Convert to platform remove callback returning void (Uwe Kleine-Konig)
net: ipa: report when the driver has been removed (Alex Elder)
forcedeth: stop the tx_timeout register dump past the requested window (Marek Czernohous)
net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (Fan Ye)
net: bridge: Reject descending VLAN tunnel ranges (Ruoyu Wang) [Orabug: 40041549] {CVE-2026-90114}
RDMA/ucma: Allow path records to exactly fit the output buffer (Serhat Kumral)
ALSA: control: Use automatic cleanup of kfree() (Takashi Iwai)
prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator (Bradley Morgan)
rtc: pcf8563: fix clock provider leak on unbind (Yi Ding) [Orabug: 40041589] {CVE-2026-90126}
vdpa/mlx5: fix wrong list iterated in add_direct_chain error path (Li Rongqing) [Orabug: 40041595] {CVE-2026-90128}
virtio_balloon: disable indirect descriptors (Michael S. Tsirkin)
i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode (Jian-Ming Liao)
i3c: mipi-i3c-hci: Refactor PIO register initialization (Adrian Hunter)
i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (Adrian Hunter)
i3c: mipi-i3c-hci: Quieten initialization messages (Adrian Hunter)
i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1 (Jarkko Nikula)
i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes (Jarkko Nikula)
bonding: initialize err for empty target lists (Ruoyu Wang)
vsock: use sock_error() to consume sk_err after a failed connect (Nguyen Dinh Phi)
platform/x86: dell-wmi-sysman: Fix instance ID bounds (Hyeongjun An)
8139cp: fix Rx and Tx not being disabled in cp_suspend (Karl Mehltretter)
ALSA: hda: Fix connection list comparison in proc output (Xu Rao)
fs/ntfs3: validate ef->size covers the record's name and value (Weiming Shi)
fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() (Konstantin Komarov)
cuse: wait for pending RCU callbacks on module exit (Baokun Li) [Orabug: 40041629] {CVE-2026-90140}
net: bridge: vlan: fix inverted default vlan notification (Nikolay Aleksandrov)
ipvs: fix integer overflow in ftp helper port/address parsing (Joas Antonio Dos Santos) [Orabug: 40041632] {CVE-2026-90141}
net: hsr: Use full string description when opening HSR network device (Lukasz Majewski)
hsr: Use a single struct for self_node. (Sebastian Andrzej Siewior)
pppox: drain queued packets on channel handoff (Qingfang Deng)
net: kcm: Hold RCU read lock while running BPF parser (Junseo Lim)
NFSv4: remove callback IDR entry on client allocation failure (Ruoyu Wang) [Orabug: 40041663] {CVE-2026-90151}
nfs: refactor pNFS functions using clear_and_wake_up_bit (Arnaud Bonnet)
nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper (Arnaud Bonnet)
bpf: Reject negative optlen in cgroup getsockopt hook (Junseo Lim) [Orabug: 40041688] {CVE-2026-90157}
lwt_bpf: Restore reserved headroom after xmit program (Junseo Lim) [Orabug: 40041697] {CVE-2026-90160}
smb/server: preserve error status in smb2_handle_negotiate() (Zhangguodong)
hwmon: (emc1403) Add support for EMC1442 (Delphine Cc Chiu)
mailbox: rockchip: disable pclk on probe failure and unbind (Linmao Li)
perf dso: Guard against cache underflow on short reads in dso_cache__memcpy() (Arnaldo Carvalho de Melo)
perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path() (Arnaldo Carvalho de Melo)
crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (Zhushuai Yin)
bpf: Fix pending_pos walk on 32-bit ring position wrap (Israel Tellez Garcia)
tracing: Have trace_event_update_all() only handle module that is loading (Steven Rostedt)
tracing: Remove 'attribute()' from the type field of event format (Masami Hiramatsu)
ALSA: core: Fix use-after-free in snd_card_do_free() (Aleksandr Nogikh) [Orabug: 40041815] {CVE-2026-90198}
scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Chandrakanth Patil) [Orabug: 40041829] {CVE-2026-90202}
Squashfs: check block offset is not negative (Phillip Lougher) [Orabug: 40041835] {CVE-2026-90203}
ocfs2: fix circular locking dependency in ocfs2_init_acl() (Krystian Kaniewski) [Orabug: 40072807] {CVE-2026-93252}
bpftool: Fix double close in map dump (Yuan Chen)
x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported (Bijan Tabatabai)
clocksource/drivers/armada: Unwind timer clock on init failure (Yuho Choi)
clocksource/drivers/clps711x: Do not unmap clocksource MMIO (Guangshuo Li)
s390/debug: Fix deadlock during unregister (Peter Oberparleiter)
xenbus: Unregister reboot notifier on init failure (Yuho Choi)
power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (Henrik Grimler)
power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (Henrik Grimler)
power: supply: bq27xxx: bq27520g4: fix REG_TTES address (Henrik Grimler)
power: supply: bd99954: Drop bad register fields (Matti Vaittinen)
spi: img-spfi: don't disable runtime PM on DMA deferred probe (Felix Gu)
selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM (Vineet Gupta)
selftests/bpf: Add description for running vmtest on RV64 (Pu Lehui)
selftests/bpf: Support local rootfs image for vmtest (Pu Lehui)
selftests/bpf: Limit URLS parsing logic to actual scope in vmtest (Pu Lehui)
selftests/bpf: Fix vmtest.sh getopts optstring (Daniel Xu)
bpf/docs: Update list of architectures supported. (Kp Singh)
selfetests/bpf: Adapt vmtest.sh to s390 libbpf CI changes (Ilya Leoshkevich)
selfetests/bpf: Update vmtest.sh defaults (Yucong Sun)
UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC (Ran Hongyun)
ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (Rosen Penev)
ubi: Fix rollback for explicit UBI device numbers (Yuho Choi) [Orabug: 40041884] {CVE-2026-90216}
ubi: fastmap: Add module parameter to control reserving filling pool PEBs (Zhihao Cheng)
ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs (Zhihao Cheng)
ubi: fastmap: Wait until there are enough free PEBs before filling pools (Zhihao Cheng)
ubi: Simplify bool conversion (Yang Li)
ubi: fastmap: Add fastmap control support for module parameter (Zhaolong Wang)
ubi: fastmap: Add fastmap control support for 'UBI_IOCATT' ioctl (Zhihao Cheng)
UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs (Zhihao Cheng)
UBI: Preserve torture flag when rescheduling failed erasures (Zhihao Cheng)
ubi: Replace erase_block() with sync_erase() (Zhihao Cheng)
ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap (Zhihao Cheng)
ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash (Zhihao Cheng)
ubi: fastmap: Fix missed ec updating after erasing old fastmap data block (Zhihao Cheng)
ubi: fastmap: Use the bitmap API to allocate bitmaps (Christophe Jaillet)
ubi: Fix repeated words in comments (Jilin Yuan)
ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (Liangcheng Wang)
ASoC: pxa: Use devm_clk_get_optional() for extclk clock (Bui Duc Phuc)
RDMA/cma: Fix WARNING in res_to_rt (Zhu Yanjun) [Orabug: 40041894] {CVE-2026-90218}
RDMA/cxgb4: Free debugfs on registration failure (Fan Wu) [Orabug: 40041898] {CVE-2026-90219}
dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (Guangshuo Li)
nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (Yun Zhou)
nfc: digital: Do not dump a NULL response in command completion (Linmao Li)
nfc: pn533: hold a reference to the request skb during send_frame (Yinhao Hu)
nfc: llcp: bound SNL TLV parsing to the skb and add length checks (Doruk Tan Ozturk)
nfc: nci: fix double completion race in nci_data_exchange_complete (Zhenghang Xiao)
nfc: llcp: read llcp_sock->local under the socket lock in getsockopt (Breno Leitao)
nfc: llcp: avoid userspace overflow on invalid optlen (Breno Leitao)
nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (Guixin Liu) [Orabug: 40041940] {CVE-2026-90228}
spi: sprd-adi: Fix probe succeeding without registering the controller (Babanpreet Singh)
powerpc/configs: enable CONFIG_RAS to fix EDAC support (Michael Walle)
SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (Weiming Shi) [Orabug: 40033069] {CVE-2026-89784}
m68k: Fix backtraces for non-running tasks (Karl Mehltretter)
iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes)
fbdev: kyro: Validate overlay viewport coordinates (Danila Chernetsov)
perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads (Ian Rogers)
perf synthetic-events: Fix uninitialized pthread_join (Ian Rogers)
perf stat: Fix evsel_list leak in cmd_stat (Ian Rogers)
perf stat: Clear screen only if output file is a tty (Namhyung Kim)
ARM: dts: helios4: add SATA regulator supplies (Rosen Penev)
ARM: dts: helios4: add vcc-supply to GPIO expander (Rosen Penev)
ARM: dts: helios4: add vcc-supply to EEPROM (Rosen Penev)
arm64: dts: turris-mox: fix usb3 phys (Tomas Macholda)
net/sched: cls_api: fix teardown of an adopted proto on insert-race loss (Victor Nogueira) [Orabug: 40042005] {CVE-2026-90248}
iio: light: gp2ap002: re-enable irq if runtime suspend fails (Nikhil Gautam)
iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes (Nikhil Gautam)
Bluetooth: MSFT: validate evt_prefix_len against the response length (Ali Ahmet Memis)
Bluetooth: virtio_bt: avoid OOB read of build info string (Hyeongjun An)
scsi: sd: Fix sd_done() sense handling condition (Yang Xiuwei)
perf trace-event: Fix integer truncation in do_read() and skip() (Tanushree Shah)
Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (Zijun Hu)
sched/fair: Check CPU capacity before comparing group types during load balance (Ricardo Neri)
regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (Kamal Wadhwa)
coresight: etm4x: fix underflow for usage of (nrseqstate - 1) (Levi Yun) [Orabug: 40042071] {CVE-2026-90274}
coresight: Change syncfreq to be a u8 (James Clark)
coresight: etm4x: Cleanup TRCIDR5 register accesses (James Clark)
coresight: etm4x: Cleanup TRCIDR4 register accesses (James Clark)
coresight: etm4x: Cleanup TRCIDR3 register accesses (James Clark)
coresight: etm4x: Cleanup TRCIDR2 register accesses (James Clark)
coresight: etm4x: fix wrong check of etm4x_sspcicrn_present() (Levi Yun)
phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (Loic Poulain)
soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (Linkai Gong)
hugetlbfs: release subpool on fill_super failure (Chenyichong) [Orabug: 40042091] {CVE-2026-90283}
pinctrl: rockchip: Reset the pin count when recalculating SoC data (Simon Glass)
firmware_loader: do not queue completed sysfs fallback requests (Mukesh Ojha) [Orabug: 40042095] {CVE-2026-90284}
firmware_loader: Check fw_state_is_done in loading_store (Russ Weight)
scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path (Manish Rangankar) [Orabug: 40042099] {CVE-2026-90285}
drm/amdgpu/gfx6: Use PFP on the compute queues too (Timur Kristof)
drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (Timur Kristof)
perf trace-event: Fix buffer overflow in read_string() (Tanushree Shah)
phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (Gerald Loacker)
ext4: fix spurious message about orphan cleanup on RO fs (Jan Kara)
drm/amdgpu/gfx6: Fixup emit_cntxcntl() (Timur Kristof)
mfd: iqs62x: Reject zero-length firmware records (Pengpeng Hou)
mfd: rave-sp: validate received frame payload lengths (Pengpeng Hou)
arm64: hibernate: Restore DAIF state on error (Vladimir Murzin) [Orabug: 40042117] {CVE-2026-90290}
arm64: hibernate: mask DAIF before restoring hibernated kernel (Ada Couprie Diaz) [Orabug: 40072826] {CVE-2026-93256}
RDMA/siw: Fix use-after-free in siw_accept() (Shuangpeng Bai)
RDMA/siw: Introduce siw_free_cm_id (Guoqing Jiang)
IB/isert: post the full-feature receive buffers after session registration (Yehyeong Lee) [Orabug: 40042126] {CVE-2026-90293}
IB/isert: delay the final Login Response until the session is registered (Yehyeong Lee) [Orabug: 40042130] {CVE-2026-90294}
cpufreq: imx6q: fix out-of-bounds write when probed more than once (Karl Mehltretter)
cpufreq: imx6q: fix devres accumulation across driver rebind (Karl Mehltretter)
drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (Jernej Skrabec)
drm/sun4i: dw-hdmi: Drop TCON TOP port reference (Jernej Skrabec)
drm/sun4i: tcon: Drop remote endpoint reference (Jernej Skrabec)
drm/sun4i: crtc: Propagate layer initialization error (Jernej Skrabec)
drm/sun4i: tcon: Drop TCON TOP device reference (Jernej Skrabec)
bitfield: Add non-constant field_{prep,get}() helpers (Geert Uytterhoeven)
bitfield: Add less-checking _FIELD{GET,PREP}() (Geert Uytterhoeven)
of: property: use unsigned int return on of_graph_get_endpoint_count() (Kuninori Morimoto)
of: property: add missing kerneldoc for of_graph_get_endpoint_count() (Kuninori Morimoto)
drm/sun4i: vi scaler: Fix coefficient selection (Jernej Skrabec)
ocfs2: synchronize heartbeat callbacks with o2net teardown (Cen Zhang) [Orabug: 40042163] {CVE-2026-90302}
ocfs2: use bitmap API in fill_node_map (Joseph Qi)
ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults (Yuanbin Xie)
RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (Yehyeong Lee) [Orabug: 40042182] {CVE-2026-90307}
scripts/tags.sh: Prevent binary files appearing in cscope.files (Sergei Litvin)
scripts/tags.sh: improve compiled sources generation (Jialu Xu)
remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() (Mukesh Ojha) [Orabug: 40042202] {CVE-2026-90314}
remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources() (Mukesh Ojha)
remoteproc: Move resource table data structure to its own header (Mukesh Ojha)
PCI/sysfs: Add static PCI resource attribute macros (Krzysztof Wilczynski)
drm/omap: dsi: Do not copy isr table (Andreas Kemnade) [Orabug: 40042212] {CVE-2026-90316}
fat: release buffer head after rebuilding parent (Chenyichong) [Orabug: 40042220] {CVE-2026-90318}
rapidio: clear mport->net when rio_add_net() fails (Guangshuo Li)
pps-gpio: remove dead capture_clear code (Calvin Owens)
pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler (Michael Byczkowski)
pps: clients: gpio: Bypass edge's direction check when not needed (Bastien Curutchet)
pps: don't try to wait for negative timeouts in PPS_FETCH (Calvin Owens)
lib/string: fix memchr_inv() for large ranges (Bradley Morgan)
block/kyber-iosched: flush per-cpu latency buckets over possible CPUs (Tao Cui)
block/blk-iocost: collect per-cpu latency stats over possible CPUs (Tao Cui)
block/blk-stat: drain per-cpu callback stats over possible CPUs (Tao Cui)
phonet: pep: do not write beyond optlen in getsockopt (Breno Leitao) [Orabug: 40042250] {CVE-2026-90327}
iio: light: tsl2583: return zero in write_raw() on success (Sang-Heon Jeon)
iio: light: isl29028: return zero in write_raw() on success (Sang-Heon Jeon)
iio: light: tsl2772: fix ALS calibscale readback (Yuanshen Cao)
perf intel-bts: Fix off-by-one in auxtrace_info minimum size check (Arnaldo Carvalho de Melo)
perf intel-pt: Fix off-by-one in auxtrace_info minimum size check (Arnaldo Carvalho de Melo)
perf auxtrace: Fix queue grow overflow and old array leak (Arnaldo Carvalho de Melo)
perf thread-stack: Fix heap buffer overflow on branch stack wrap copy (Arnaldo Carvalho de Melo)
HID: lg4ff: validate report length before fixed offsets (Jiancheng Huang)
HID: i2c-hid: Fix '(null)' output when reading report descriptor fails (Ai Chao)
HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling (Hans de Goede)
HID: synchronize input before cleaning up a failed probe (Yousef Alhouseen) [Orabug: 40042260] {CVE-2026-90329}
HID: ensure timely release of driver-allocated resources (Dmitry Torokhov)
HID: split apart hid_device_probe to make logic more apparent (Dmitry Torokhov)
tty: clear cdev pointer after cdev_add() failure (Karl Mehltretter) [Orabug: 40042274] {CVE-2026-90334}
serial: amba-pl011: unprepare console clock on unregister (Karl Mehltretter)
MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL (Thomas Bogendoerfer)
powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass (Gou Hao)
firmware: coreboot: Validate table bounds (Laxman Acharya Padhya)
firmware: google: Add bounds checks in coreboot_table_populate() (Titouan Ameline de Cadeville)
wifi: mac80211: skip unused probe response countdown offsets (Catherine)
wifi: zd1211rw: reject secondary interfaces to prevent conflicts (Slawomir Stepien)
wifi: mac80211: send TWT teardown to peer after setup TX failure (Catherine)
iommu/arm-smmu-v3: Convert to use atomic poll timeout (Pranjal Shrivastava)
wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (Linghui Wu)
perf machine: Check snprintf truncation for guest kallsyms path (Arnaldo Carvalho de Melo)
perf machine: Free scandir entries in guest kernel map creation (Arnaldo Carvalho de Melo)
perf machine: Reset errno before strtol in guest kernel map creation (Arnaldo Carvalho de Melo)
perf machine: Don't abort guest map creation on first inaccessible dir (Arnaldo Carvalho de Melo)
perf machine: Check snprintf truncation in machines__findnew() (Arnaldo Carvalho de Melo)
perf machine: Use snprintf() for guestmount path construction (Arnaldo Carvalho de Melo)
perf machine: Guard against NULL strlist in machines__findnew() (Arnaldo Carvalho de Melo)
regulator: core: use system_freezable_wq for init complete work (Joy Zou) [Orabug: 40042349] {CVE-2026-90360}
wifi: ath11k: fix leak in ath11k_service_ready_ext_event() (Jeff Johnson) [Orabug: 40042353] {CVE-2026-90361}
drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (Konrad Dybcio) [Orabug: 40042356] {CVE-2026-90362}
perf: arm_spe: Make wakeup range check overflow safe (Leo Yan)
wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (Felix Fietkau)
wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (Felix Fietkau) [Orabug: 40042387] {CVE-2026-90372}
wifi: mt76: mt792x: Fix memory leak in SDIO TX path (Eason Lai)
wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (Lucid Duck) [Orabug: 40042410] {CVE-2026-90382}
fanotify: report full event length for FIONREAD (Chenyichong)
misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (Abdun Nihaal)
locking/lockdep: Fix NULL pointer dereference in __lock_set_class() (Naveen Kumar Chaudhary)
i3c: master: Fix device_register() error path (Adrian Hunter)
i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (Jakub Kicinski)
iommu/dma: Check atomic pool allocation result directly (Aneesh Kumar K V) [Orabug: 40042431] {CVE-2026-90388}
clk: qcom: Return expected ENOMEM error on dynamic allocation failure (Vladimir Zapolskiy)
lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone (Stanislav Kinsburskii)
bpf: Fix potential UAF in bpf_netns_link_update_prog (Pu Lehui) [Orabug: 40042447] {CVE-2026-90393}
power: supply: sc2731_charger: cancel work on remove (Hongyan Xu)
power: supply: sc2731_charger: Convert to platform remove callback returning void (Uwe Kleine-Konig)
power: supply: isp1704_charger: cancel work on remove (Hongyan Xu) [Orabug: 40042457] {CVE-2026-90395}
selftests/zram: fix kernel_gte() for POSIX sh (Cheng-Han Wu)
md/raid5-ppl: fix use-after-free in ppl_do_flush() (Sajal Gupta) [Orabug: 40072849] {CVE-2026-93262}
bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (Manivannan Sadhasivam)
wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (Abdun Nihaal) [Orabug: 40042478] {CVE-2026-90403}
nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request (Guixin Liu) [Orabug: 40042499] {CVE-2026-90411}
IB/isert: reject login PDUs declaring more data than was received (Yehyeong Lee) [Orabug: 40042504] {CVE-2026-90413}
IB/isert: reject PDUs declaring more data than was received (Yehyeong Lee) [Orabug: 40042508] {CVE-2026-90414}
RDMA/cxgb4: free STAG index when TPT entry write fails (Leon Romanovsky) [Orabug: 40042512] {CVE-2026-90415}
RDMA/mlx5: Send cong param changes to the resolved port mdev (Leon Romanovsky)
RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs (Leon Romanovsky) [Orabug: 40042520] {CVE-2026-90416}
scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches. (David Strahan)
nilfs2: prevent out-of-bounds read in super root block parsing (David Lee)
nilfs2: fix infinite loop in nilfs_clean_segments() (Joshua Crofts)
clk/x86: pmc_atom: add kasprintf return value check (Longlong Yan)
clk: palmas: Manage external-control prepare with devm (Myeonghun Pak)
clk: tegra: tegra124-emc: put EMC node on register failure (Guangshuo Li)
arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix (Ondrej Jirman)
RDMA/efa: Fix PBL chunk length computation (Yonatan Nachum) [Orabug: 40072858] {CVE-2026-93264}
fs/ntfs3: reject restart table growth beyond U16_MAX entries (Weiming Shi)
staging: rtl8723bs: use kfree_sensitive() for key material (Ivy Lopez)
remoteproc: Prevent crash handling to race with rproc_del() (Bjorn Andersson) [Orabug: 40042566] {CVE-2026-90431}
remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work() (Jingyi Wang)
remoteproc: Use unbounded workqueue for recovery work (Mukesh Ojha)
w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (Babanpreet Singh)
isofs: release zisofs block pointer buffer head (Chenyichong) [Orabug: 40042576] {CVE-2026-90434}
RDMA/mlx5: Fix integer overflow of user QP buffer size (Maher Sanalla) [Orabug: 40042580] {CVE-2026-90435}
crypto: keembay - publish OF module alias for OCS AES/SM4 (Can Peng)
crypto: keembay - Initialize completion before requesting IRQ (Linmao Li)
power: supply: sbs-battery: Use a per-device serial number buffer (Babanpreet Singh)
ARM: lpc32xx: only run SoC init on LPC32xx hardware (Karl Mehltretter)
arm64: dts: rockchip: Fix Gru WLAN sideband interrupt (Fabio Estevam)
arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru (Rob Herring)
arm64: dts: rockchip: Add gru-scarlet-dumo board (Chen-Yu Tsai)
fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init (Weiming Wu)
netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet (Florian Westphal) [Orabug: 40079958] {CVE-2026-100070}
drm/tve200: add OF module alias for autoloading (Can Peng)
leds: pca9532: Fix phantom device registration on missing hardware (Cosmo Chou)
perf cs-etm: Avoid truncating AUX buffer sizes to int (Leo Yan)
perf cs-etm: Flush thread stacks after decoder reset (Leo Yan)
ARM: dts: allwinner: a10: Fix PMU interrupt (Andre Przywara)
ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() (Xiang Mei) [Orabug: 40033090] {CVE-2026-89787}
ext4: fix buffer_head leak in ext4_init_orphan_info (Guanghui Yang) [Orabug: 40042631] {CVE-2026-92494}
wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (Jeff Johnson) [Orabug: 40042636] {CVE-2026-92496}
ath11k: add trace log support (Venkateswara Naralasetty)
wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (Jeff Johnson)
wifi: ath6kl: avoid buffer overreads in WMI event handlers (Jeff Johnson) [Orabug: 40042641] {CVE-2026-92498}
ext4: drain in-flight DIO before buffered write fallback (Baokun Li) [Orabug: 40042653] {CVE-2026-92501}
thermal: intel: int3400: clean up ODVP on probe failures (Pengpeng Hou) [Orabug: 40042661] {CVE-2026-92504}
thermal: int340x_thermal: Consolidate priv->data_vault checks (Rafael J. Wysocki)
iommu/qcom: Fix inverted fault report check in qcom_iommu_fault() (Mukesh Ojha)
iommu/qcom: Remove sysfs device on probe failure path (Haoxiang Li)
iommu/arm-smmu: Add missing pm_runtime_disable() in qcom_iommu_device_probe (Miaoqian Lin)
RDMA/core: Fix potential use after free in ib_free_cq() (Patrisious Haddad) [Orabug: 40042671] {CVE-2026-92508}
RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq() (Mark Zhang)
RDMA/restrack: Fix typos in the comments (Kalesh Ap)
RDMA/srpt: Pass the mapped task attribute to target_init_cmd() (Leon Romanovsky)
ext4: skip extra isize expansion during mount to prevent deadlock (Yun Zhou) [Orabug: 40072874] {CVE-2026-93268}
ext4: fix out-of-bounds read in ext4_read_inline_dir() (Xiang Mei) [Orabug: 40033084] {CVE-2026-89786}
ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (Chen Pei) [Orabug: 40042714] {CVE-2026-92521}
ACPI: processor: validate MADT IOAPIC entry bounds (Pengpeng Hou) [Orabug: 40042719] {CVE-2026-92522}
irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() (Kemeng Shi) [Orabug: 40042729] {CVE-2026-92524}
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (Zheng Tan) [Orabug: 40079981] {CVE-2026-100075}
RDMA/hfi1: Propagate sdma_txinit_ahg() errors (Danila Chernetsov) [Orabug: 40042739] {CVE-2026-93037}
arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe (Yan Jun)
ASoC: meson: Keep link pointers valid on realloc failure (Linmao Li) [Orabug: 40042746] {CVE-2026-93039}
dmaengine: dw-edma: Clear stale requests on termination (Koichiro Den)
dmaengine: dw-edma: Serialize channel state checks (Koichiro Den)
dmaengine: dw-edma: Serialize abort state updates (Koichiro Den)
driver core: soc: Unregister bus on early device registration failure (Yuho Choi)
driver core: soc: remove layering violation for the soc_bus (Greg Kroah-Hartman)
software node: Fix software_node_get_reference_args() with index -1 (Alban Bedel) [Orabug: 40042772] {CVE-2026-93046}
perf ui hists: Fix uninitialized stack memory free on pstack allocation failure (Ian Rogers)
mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (Zhouminqiang) [Orabug: 40042782] {CVE-2026-93048}
mtd: mtdswap: Avoid freeing registered blktrans device twice (Ruoyu Wang) [Orabug: 40042803] {CVE-2026-93049}
vfio/pci: clear vdev->msi_perm after freeing it on init failure (Xiang Mei) [Orabug: 40033020] {CVE-2026-89777}
char: xilinx_hwicap: unregister class on init errors (Myeonghun Pak)
ppdev: prevent overflow when setting port timeout (Linmao Li)
misc: ad525x_dpot: use driver core groups for sysfs files (Pengpeng Hou) [Orabug: 40042818] {CVE-2026-93051}
misc: ad525x_dpot: Make ad_dpot_remove() return void (Uwe Kleine-Konig)
misc: rtsx: add missing write register handling (Gleb Markov)
misc: bcm-vk: Use acquire/release for msgq_inited (Gui-Dong Han)
speakup: keyhelp: guard letter_offsets possible out-of-range indexing (Pavel Zhigulin)
accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (Christophe Jaillet)
uio: Fix stale info pointer in failed registration path (Yuho Choi) [Orabug: 40042833] {CVE-2026-93054}
UDF symlink pathComponent header OOB read (David Lee) [Orabug: 40042841] {CVE-2026-93055}
tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (Karl Mehltretter)
usb: gadget: f_uac1_legacy: remove broken string configfs attributes (Xu Yang) [Orabug: 40042849] {CVE-2026-93056}
ACPI: processor: idle: Expand _LPI package sanity checks (Rafael J. Wysocki)
ACPI: move from strlcpy() with unused retval to strscpy() (Wolfram Sang)
crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (Thorsten Blum)
gpu: host1x: Avoid stack over-read in debug output helpers (Mikko Perttunen) [Orabug: 40042866] {CVE-2026-93061}
gpu: host1x: Fix offset calculation in trace_write_gather (Mikko Perttunen)
arm64: dts: qcom: sm8250: Add camcc DT node (Bryan O'Donoghue)
arm64: dts: qcom: sm8250: remove mmcx regulator (Dmitry Baryshkov)
arm64: dts: qcom: sm8250: Use QMP property to control load state (Sibi Sankar)
drm/bridge: tc358767: clamp the reported AUX read size to the request (Maoyi Xie) [Orabug: 40042884] {CVE-2026-93067}
remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev (Uday Khare)
cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply() (Zhongqiu Han)
cpufreq: intel_pstate: Fix setting minimum P-state at init time (Rafael J. Wysocki)
genirq/generic_chip: Introduce irq_domain_{alloc,remove}_generic_chips() (Herve Codina)
irqdomain: Handle additional domain flags in irq_domain_instantiate() (Herve Codina)
irqdomain: Introduce irq_domain_instantiate() (Herve Codina)
irqdomain: Introduce irq_domain_free() (Herve Codina)
cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate() (Dan Carpenter)
libnvdimm/labels: Bound the on-media label size before the shift (Bryam Vargas)
wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (Baochen Qiang) [Orabug: 40072894] {CVE-2026-93271}
hfsplus: validate thread record before delete key rebuild (Kyle Zeng)
rpmsg: glink: fix deadlock in endpoint destroy during driver detach (Vishnu Santhosh) [Orabug: 40043409] {CVE-2026-93098}
rpmsg: glink: remove duplicate code for rpmsg device remove (Srinivas Kandagatla)
rpmsg: glink: Remove the rpmsg dev in close_ack (Arun Kumar Neelakantam)
isofs: fix out-of-bounds page array access on empty zisofs block (Xiang Mei) [Orabug: 40033029] {CVE-2026-89778}
fs/isofs: replace kmap() with kmap_local_page() (Fabio M. De Francesco)
RDMA/hfi1: Initialize debugfs after probe completes (Leon Romanovsky)
RDMA/hfi1: Stop flushing the global IB workqueue (Leon Romanovsky)
RDMA/hfi1: Create workqueues before device initialization (Leon Romanovsky)
RDMA/hfi1: Remove redundant PCI device ID validation (Leon Romanovsky)
RDMA/hfi1: Free RX data on late probe failure (Leon Romanovsky) [Orabug: 40042983] {CVE-2026-93102}
RDMA/hfi1: Preserve unit 0 on allocation failure (Leon Romanovsky) [Orabug: 40042988] {CVE-2026-93103}
misc: rtsx_usb: avoid USB I/O in runtime autosuspend (Sean Rhodes)
pmdomain: bcm: bcm2835: handle genpd provider registration errors (Pengpeng Hou)
ALSA: hpi: Check transport errors during HPI6000 adapter initialization (Evgenii Burenchev)
xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full (Xiang Mei) [Orabug: 40033063] {CVE-2026-89783}
hwrng: ks-sa - Fix runtime PM cleanup on registration failure (Yuho Choi)
hwrng: ks-sa - access private data via struct hwrng (Martin Kaiser)
RDMA/ipoib: Drain RCU callbacks during module teardown (Leon Romanovsky) [Orabug: 40043009] {CVE-2026-93108}
RDMA/mlx5: Drain RCU callbacks during module teardown (Leon Romanovsky) [Orabug: 40043015] {CVE-2026-93109}
RDMA/core: Wait for RCU callbacks before unloading ib_core (Leon Romanovsky) [Orabug: 40043022] {CVE-2026-93110}
RDMA/core: Avoid flush_workqueue(system_unbound_wq) usage (Tetsuo Handa)
iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (Mert Seftali)
drm/panel: samsung-s6d16d0: Power off on prepare failure (Laxman Acharya Padhya)
usb: renesas_usbhs: Fix power-off ordering on unbind (Biju Das)
usb: mtu3: allow system suspend during active gadget connection (Fei Shao)
platform/surface: acpi-notify: Check ACPI companion before use (Linmao Li)
platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (Linmao Li)
usb: gadget: configfs: fix out-of-bounds read of qw_sign (Michael Bommarito) [Orabug: 40043062] {CVE-2026-93120}
hwspinlock: propagate errno when registering single lock (Wolfram Sang)
platform/x86: dell-wmi-base: Fix resource leak on module load failure (Armin Wolf) [Orabug: 40043089] {CVE-2026-93130}
platform/x86: dell-privacy: Fix race condition (Armin Wolf)
leds: pca9532: Fix inverted GPIO output polarity (Cosmo Chou)
iommu/amd: Fix false positive in SB IOAPIC IVRS validation (Wei Wang)
iommu/amd: Add support for Hygon family 18h model 4h IOAPIC (Fu Hao)
iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors (Wei Wang)
iommu/msm: Return -ENOMEM on memory allocation failure in probe (Vladimir Zapolskiy)
iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX (Akari Tsuyukusa)
efi: fix stale reference to efi_recover_from_page_fault() (Breno Leitao)
bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux (Daniel Borkmann) [Orabug: 40043115] {CVE-2026-93138}
udf: Mark LVID buffer as uptodate before marking it dirty (Aleksandr Nogikh) [Orabug: 40043122] {CVE-2026-93140}
usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (Hongyan Xu)
clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() (Herman van Hazendonk) [Orabug: 40043147] {CVE-2026-93145}
clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
clk: qcom: gdsc: enable optional power domain support (Dmitry Baryshkov)
clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains (Herman van Hazendonk)
clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status (Herman van Hazendonk)
timekeeping: Account for monotonicity adjustment in ntp_error (David Woodhouse)
y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32 (Thomas Weissschuh)
clocksource: Unregister subsystem on device registration failure (Yuho Choi)
selftests: timers: leap-a-day: Fix -w option and update usage comment (Jiangshan Yi)
irqchip/gic-v3-its: Fix memleak in its_probe_one() (Kemeng Shi)
selftests/bpf: Fix memory leak in msg_alloc_iov (Feng Yang)
selftests/bpf: Fix memory leak in msg_alloc_iov error path (Malaya Kumar Rout)
ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (Evgenii Burenchev)
staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (Dawei Feng) [Orabug: 40079942] {CVE-2026-98160}
staging: fbtft: Use sysfs_emit_at() to print to sysfs file (Dan Carpenter)
greybus: audio: bound the topology section sizes against the fetched size (Bryam Vargas)
staging: sm750fb: gate dualview dataflow using g_dualview (Ahmet Sezgin Duran)
staging: greybus: audio: correct sscanf() return value check (Alexander A. Klimov)
PM: sleep: Fix off-by-one in wakelocks number limit check (Tuhaowen)
bus: ti-sysc: Fix /chosen node reference leak (Yuho Choi)
nvmet-rdma: fix response resource leak on queue teardown (Shin'Ichiro Kawasaki) [Orabug: 40043175] {CVE-2026-93151}
nvmet-rdma: factor out response resource cleanup (Shin'Ichiro Kawasaki)
nvmet-rdma: use sbitmap to replace rsp free list (Guixin Liu)
nvmet-rdma: avoid circular locking dependency on install_queue() (Hannes Reinecke)
crypto: sa2ul - stop probe if context pool creation fails (Pengpeng Hou)
crypto: sa2ul - Use the defined variable to clean code (Tang Bin)
crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (Lothar Rubusch)
crypto: atmel-ecc - reject hardware ECDH without a public key (Thorsten Blum)
crypto: atmel-ecc - clean up and improve ECDH comments (Thorsten Blum)
crypto: atmel-ecc - replace min_t with min (Thorsten Blum)
crypto: qat - clear AES key schedule from stack (Giovanni Cabiddu) [Orabug: 40043212] {CVE-2026-93161}
platform/chrome: sensorhub: Fix memory overread in ring handler (Tzung-Bi Shih) [Orabug: 40043224] {CVE-2026-93165}
selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check (Hisam Mehboob)
csky: Fix a4/a5 restoration in syscall trace path (Hanlin Song)
iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (Sanjay Chitroda)
soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (Srinivas Kandagatla)
dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (Vladimir Zapolskiy)
dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (Suraj Gupta)
dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (Vladimir Zapolskiy)
tools/bpf/bpftool: Reset vmlinux BTF after map commands (Chenyichong)
bpftool: Fix pretty print dump for maps without BTF loaded (Jiri Olsa)
bpftool: Use libbpf_get_error() to check error (Hengqi Chen)
bpftool: Update btf_dump__new() and perf_buffer__new_raw() calls (Andrii Nakryiko)
drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (Asad Kamal) [Orabug: 40043261] {CVE-2026-93177}
drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (Asad Kamal) [Orabug: 40043267] {CVE-2026-93178}
perf tests: Fix flakiness in BPF counters test on hybrid systems (Ian Rogers)
perf test: Fix perf stat --bpf-counters on hybrid machines (Namhyung Kim)
perf test: Use sqrtloop workload to test bperf event (Tengda Wu)
perf test stat_bpf_counter.sh: Stabilize the test results (Veronika Molnarova)
perf test bpf-counters: Add test for BPF event modifier (Ian Rogers)
perf test: raise limit to 20 percent for perf_stat_--bpf-counters_test (Thomas Richter)
perf tests stat_bpf_counters: Fix usage of '==' to address shellcheck warning (Athira Rajeev)
media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (Sean Young)
media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (Sean Young)
pinctrl: bcm2835: Don't remove an unregistered GPIO chip (Daniel Mccarthy) [Orabug: 40072907] {CVE-2026-93274}
perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails (Zide Chen)
drm/lima: call drm_mm_init() with a valid allocation range (Henrik Grimler)
clk: imx: scu: drop redundant init.ops variable assignment (Brian Masney)
ARM: imx: fix device_node refcount leaks in imx7_src_init() (Weigang He)
ARM: imx: fix device_node refcount leak in imx_src_init() (Weigang He)
clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller (Min Zhang)
ASoC: rt700-sdw: always drain jack work on remove (Runyu Xiao) [Orabug: 40043295] {CVE-2026-93185}
clk: moxart: remove unused variables, fix refcount leak (Alexander A. Klimov)
media: cec-pin: Fix event FIFO ordering (Gui-Dong Han)
soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (Weigang He)
HID: roccat: bound device-supplied profile index (Michael Bommarito) [Orabug: 40043302] {CVE-2026-93188}
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (Philipp Weber) [Orabug: 40043306] {CVE-2026-93189}
smack: restrict smackfs/{direct,mapped} values to 0-255 (Konstantin Andreev)
smack: deduplicate smackfs/{direct,mapped} file_operations (Konstantin Andreev)
smack: simplify write handlers of sysfs entries (Dmitry Antipov)
smack: fix incorrect task context in smack_msg_queue_msgrcv (Konstantin Andreev)
Smack: fix W=1 build warnings (Casey Schaufler)
drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (Maxime Ripard)
bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann) [Orabug: 38649013] {CVE-2025-40123}
clk: meson: align gxbb_32k_clk_sel number of parents with actual count (Martin Blumenstingl) [Orabug: 40033896] {CVE-2026-89947}
firmware: stratix10-svc: Add mutex in stratix10 memory management (Mahesh Rao)
perf sched: Fix register_pid() overflow, strcpy, and BUG_ON (Arnaldo Carvalho de Melo)
batman-adv: bla: avoid CRC corruption due to parallel claim add (Sven Eckelmann) [Orabug: 40043348] {CVE-2026-93203}
batman-adv: dat: atomically update mac addresses (Sven Eckelmann) [Orabug: 40043352] {CVE-2026-93204}
ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE (Sean Shen)
ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei) [Orabug: 37844228] {CVE-2025-22039}
net: hns3: don't auto enable misc vector (Jian Shen)
bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (Jiayuan Chen) [Orabug: 39622004] {CVE-2026-53078}
bridge: mrp: reject zero test interval to avoid OOM panic (Xiang Mei)
net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844463] {CVE-2025-22103}
net: hns3: fix kernel crash when 1588 is sent on HIP08 devices (Jie Wang)
ax25: fix use-after-free bugs caused by ax25_ds_del_timer (Duoming Zhou)
bpf: Guard stack limits against 32bit overflow (Andrei Matei) [Orabug: 37283390] {CVE-2023-52676}
x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Steve Wahl) [Orabug: 37206382] {CVE-2024-50017}
mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of() (Seongjae Park)
mm/damon/vaddr-kunit: check region count in three_regions test (Seongjae Park)
mm/damon/vaddr: drop last same folio access check optimization (Seongjae Park)
mm/damon/core-kunit: check region count before testing in split_at() (Seongjae Park)
xhci: fix lost bounce buffers on TDs spanning several ring segments (Arthur Gautier) [Orabug: 40034134] {CVE-2026-90015}
drm/nouveau: Use write-combined maps for coherent (Faith Ekstrand)
drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (Sunil Khatri)
drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (Thadeu Lima de Souza Cascardo) [Orabug: 40033274] {CVE-2026-89816}
drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (Kavan Smith)
drm/gud: validate TV mode names before creating enum property (Tao Yu) [Orabug: 40072729] {CVE-2026-93234}
drm/gud: NUL-terminate TV mode names read from the device (Deepanshu Kartikey) [Orabug: 40033282] {CVE-2026-89817}
drm/amd/display: avoid divide-by-zero in __is_lut_linear() (Harry Wentland) [Orabug: 40033294] {CVE-2026-89821}
drm/hibmc: Fix list of formats on the primary plane (Thomas Zimmermann)
drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (Xu Wang)
drm: fix race between partial drm_dev_register() failure and ioctl (Danilo Krummrich) [Orabug: 40033314] {CVE-2026-89823}
drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (Johan Hovold)
f2fs: fix i_size when pinned fallocate partially fails (Zhan Xusheng)
f2fs: return writeback error from collapse range (Wenjie Qi)
f2fs: reject overlapping move range after len expansion (Hao-Qun Huang)
f2fs: return symlink writeback errors (Wenjie Qi)
scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak (Nilesh Javali) [Orabug: 40033434] {CVE-2026-89843}
scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics (Nilesh Javali)
scsi: qla2xxx: Drop vport reference under lock in report ID acquisition (Nilesh Javali)
scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() (Nilesh Javali) [Orabug: 40033450] {CVE-2026-89845}
scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (Nilesh Javali) [Orabug: 40033458] {CVE-2026-89846}
scsi: qla2xxx: Avoid double completion in async IOCB timeout (Nilesh Javali) [Orabug: 40033466] {CVE-2026-89847}
scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() (Nilesh Javali) [Orabug: 40072776] {CVE-2026-93242}
scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path (Nilesh Javali) [Orabug: 40033478] {CVE-2026-89849}
scsi: qla2xxx: Don't query firmware state while chip is down (Nilesh Javali) [Orabug: 40033484] {CVE-2026-89850}
scsi: qla2xxx: Fix FCE trace enable parsing in debugfs (Nilesh Javali) [Orabug: 40033491] {CVE-2026-89851}
scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() (Nilesh Javali) [Orabug: 40033498] {CVE-2026-89852}
scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump (Nilesh Javali) [Orabug: 40033505] {CVE-2026-89853}
scsi: qla2xxx: Fix cs84xx use-after-free on host teardown (Nilesh Javali) [Orabug: 40033511] {CVE-2026-89854}
scsi: qla2xxx: Serialize flash version read in reset handler (Nilesh Javali) [Orabug: 40033520] {CVE-2026-89855}
scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation (Nilesh Javali) [Orabug: 40033524] {CVE-2026-89856}
scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() (Nilesh Javali) [Orabug: 40033533] {CVE-2026-89858}
scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() (Nilesh Javali)
scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() (Nilesh Javali) [Orabug: 40033547] {CVE-2026-89861}
scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters (Nilesh Javali)
scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check (Nilesh Javali) [Orabug: 40033554] {CVE-2026-89863}
scsi: qla2xxx: Bound i2c->length in I2C bsg handlers (Nilesh Javali) [Orabug: 40033558] {CVE-2026-89864}
scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers (Nilesh Javali) [Orabug: 40033562] {CVE-2026-89865}
media: vimc: fix pixel format lookup in enum_framesizes (Arash Golgol)
media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (Uday Khare)
media: venus: fix payload size calculation in parse_raw_formats() (Mohammed El Kadiri)
media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (Mohammed El Kadiri)
media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (Biren Pandya) [Orabug: 40033584] {CVE-2026-89872}
media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (Ming Qian)
media: tda18250: fix possible integer overflow (Ilya Krutskih) [Orabug: 40033595] {CVE-2026-89876}
media: s2255: check firmware size before reading trailing marker (Huanglei) [Orabug: 40033610] {CVE-2026-89878}
media: s2255: bound JPEG frame size before copying into the buffer (Hyeongjun An) [Orabug: 40033615] {CVE-2026-89879}
media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (Valery Borovsky) [Orabug: 40033620] {CVE-2026-89880}
media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (Valery Borovsky) [Orabug: 40033627] {CVE-2026-89881}
media: rc: sunxi-cir: Unregister rc device on probe failure (Myeonghun Pak)
media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (Christian Hewitt)
media: i2c: ov7740: fix use-after-destroy in remove (Biren Pandya)
media: i2c: ov02a10: fix endpoint parsing use-after-free (Biren Pandya)
media: go7007: defer the ALSA v4l2 put until card release (Shuangpeng Bai) [Orabug: 40033656] {CVE-2026-89890}
media: em28xx: fix use-after-free of dev_next->devlist on disconnect (Jiangong Han) [Orabug: 40033663] {CVE-2026-89891}
media: em28xx: defer audio-only extension registration (Diego Fernando Mancera Gomez) [Orabug: 40033668] {CVE-2026-89892}
media: cx23885: cancel NetUP CI work before teardown (Fan Wu) [Orabug: 40033675] {CVE-2026-89893}
media: cx231xx: reject geometry changes while the VBI queue is busy (Bryam Vargas) [Orabug: 40033680] {CVE-2026-89894}
media: cobalt: Avoid freeing ALSA private data twice (Ruoyu Wang)
media: cedrus: fix memory leak in cedrus_init_ctrls() (Dawei Feng)
media: cec: Serialize exclusive follower delivery (Ruoyu Wang) [Orabug: 40033697] {CVE-2026-89897}
media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (Yi Ding)
media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (Valery Borovsky)
KVM: s390: Restore sigset on error path (Christian Borntraeger)
KVM: s390: Zero initialize irq in reinject_machine_check (Christian Borntraeger)
KVM: s390: Free guest debug data on vcpu destroy (Christian Borntraeger)
KVM: s390: Fix old_data leak in guest debug error path (Christian Borntraeger)
KVM: s390: Fix memory leak in guest debug handling (Christian Borntraeger)
KVM: s390: Fix length check __import_wp_info() (Christian Borntraeger)
KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (Carlos Lopez) [Orabug: 40033805] {CVE-2026-89927}
KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (Yosry Ahmed) [Orabug: 40033822] {CVE-2026-89930}
KVM: nVMX: Always flush vpid02 on first use (Yosry Ahmed) [Orabug: 40033830] {CVE-2026-89932}
iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (Sanjay Chitroda)
iio: srf04: fix pm_runtime handling on probe error path (Cong Nguyen)
iio: light: gp2ap002: Disable regulators on resume failure (Laxman Acharya Padhya)
iio: light: cm32181: return zero after writing calibscale (Giorgi Tchankvetadze)
iio: gyro: mpu3050: fix sign of raw angular velocity readings (Cong Nguyen)
iio: dac: m62332: Fix regulator reference count imbalance (Erick Henrique)
iio: chemical: sgp30: Handle IAQ thread creation failure (Linmao Li)
iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (Moksh Panicker)
ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (Xu Wang)
AsoC: intel: sst: fix PCI device reference leak on probe failure (Haoxiang Li)
ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (Haoxiang Li)
ASoC: cs35l34: drain threaded IRQ before runtime suspend (Runyu Xiao) [Orabug: 40033886] {CVE-2026-89945}
ASoC: cs35l33: drain threaded IRQ before runtime suspend (Runyu Xiao)
i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (Linkai Gong)
clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks (Stephan Gerhold)
clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk (Stephan Gerhold)
clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk (Stephan Gerhold)
clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src (Stephan Gerhold)
clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src (Stephan Gerhold)
clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk (Stephan Gerhold)
clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk (Stephan Gerhold)
batman-adv: bla: prevent CRC corruptions after claim flush (Sven Eckelmann)
batman-adv: bla: fix freeing of claims on meshif deletion (Sven Eckelmann) [Orabug: 40033901] {CVE-2026-89948}
batman-adv: dat: avoid unaligned fault in IP extraction (Sven Eckelmann)
batman-adv: fix stale receive device on merged fragments (Zhiling Zou) [Orabug: 40033914] {CVE-2026-89951}
mtd: rawnand: validate ONFI extended parameter page sections (Pengpeng Hou) [Orabug: 40033918] {CVE-2026-89952}
mtd: mtdoops: free page bitmap when the backing MTD is removed (Xu Rao) [Orabug: 40033922] {CVE-2026-89953}
mtd: afs: validate v2 image info bounds (Pengpeng Hou)
parisc: Fix alignment of asm statements in head.S (Helge Deller)
parisc: eisa: Fix infinite loop when parsing invalid IRQ value (Pei Xiao)
nvdimm/btt: reject an arena whose nfree is below the lane count (Bryam Vargas) [Orabug: 40033967] {CVE-2026-89965}
Revert 'irqchip/mbigen: Fix mbigen node address layout' (Caina)
nvmet-tcp: reject unsolicited H2CData PDUs (Shivam Kumar) [Orabug: 40033975] {CVE-2026-89968}
nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU (Shivam Kumar) [Orabug: 40033979] {CVE-2026-89969}
nvme-tcp: check the data direction of a C2HData PDU (Yehyeong Lee) [Orabug: 40033995] {CVE-2026-89973}
ALSA: pcm: Fix race between non-atomic ops and trigger-start (Takashi Iwai) [Orabug: 40034012] {CVE-2026-89979}
ALSA: harmony: initialize locks before requesting IRQ (Runyu Xiao)
i2c: mux: Fix channel node leak on adapter add failure (Ahmad Byagowi) [Orabug: 40034022] {CVE-2026-89982}
i2c: core: fix debugfs UAF on adapter removal (Vasileios Almpanis) [Orabug: 40034027] {CVE-2026-89983}
perf/x86/intel: Fix kernel address leakages in LBR stack (Dapeng Mi) [Orabug: 40034032] {CVE-2026-89984}
Input: aiptek - switch to using dev_groups for driver-specific attributes (Dmitry Torokhov)
Input: aiptek - validate raw macro indices before updating state (Pengpeng Hou)
ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() (Bradley Morgan) [Orabug: 40034048] {CVE-2026-89989}
ata: ahci: work around lost interrupts on Marvell 88SE61xx (Hajo Noerenberg)
block: flag zoned disks with GENHD_FL_NO_PART (Damien Le Moal)
dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (Koichiro Den)
dmaengine: dw-edma: Complete descriptors before pausing (Koichiro Den)
dm: fix resume-vs-remove race (Mikulas Patocka) [Orabug: 40034074] {CVE-2026-89997}
HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (Ibrahim Hashimov) [Orabug: 40034087] {CVE-2026-89999}
HID: rmi: fix OOB access with undersized RMI reports (Wei Jie Law) [Orabug: 40034091] {CVE-2026-90000}
scsi: pm8001: Use rollback index when freeing MSI-X vectors (Runyu Xiao) [Orabug: 40034112] {CVE-2026-90007}
scsi: target: iscsi: Reserve a terminator byte for the login payload (Sujal Tuladhar) [Orabug: 40034119] {CVE-2026-90011}
thermal/drivers/qoriq: Disable clock on resume failure (Can Peng)
thermal/drivers/imx: Disable clock on runtime resume failure (Can Peng)
staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (Muhammad Bilal) [Orabug: 40034145] {CVE-2026-90017}
staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (Muhammad Bilal) [Orabug: 40034152] {CVE-2026-90018}
usb: gadget: fix null pointer dereference in usb_put_function_instance() (Jeffin Philip) [Orabug: 40034156] {CVE-2026-90019}
USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (Lovekesh Solanki)
usb: typec: ucsi: displayport: Fix OOB altmode array index (Jameson Thies) [Orabug: 40034211] {CVE-2026-90025}
usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (Andy Shevchenko)
usb-storage: ene_ub6250: fix race between scan work and probe (Liu Qi) [Orabug: 40034249] {CVE-2026-90031}
media: usbtv: keep device alive while ALSA card exists (Shuangpeng Bai) [Orabug: 40034260] {CVE-2026-90032}
clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset (Stephan Gerhold)
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (Hyeongjun An) [Orabug: 40034266] {CVE-2026-90033}
usb: image: mdc800: change kmalloc() to kzalloc() (Griffin Kroah-Hartman) [Orabug: 40034275] {CVE-2026-90034}
espintcp: remove encap socket caching to avoid reference leak (Sabrina Dubroca) [Orabug: 38152844] {CVE-2025-38097}
scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() (Petr Vaganov) [Orabug: 40021009] {CVE-2026-89515}
tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions (Masami Hiramatsu)
tracing/mmiotrace: Remove reference to unused per CPU data pointer (Steven Rostedt)
drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (Zack Rusin) [Orabug: 39982308] {CVE-2026-80888}
net: ntb_netdev: Fix TX busy and drop handling (Koichiro Den)
ALSA: seq: Fix port lock leak in deliver_to_subscribers() (Tzung-Bi Shih)
selinux: reject an unclaimed class value in security_get_classes() (Bryam Vargas) [Orabug: 39982374] {CVE-2026-80912}
selinux: avoid implicit conversions in services code (Christian Gottsche)
fsnotify: Fix stale object mask after concurrent mark updates (Youngjae Kwon) [Orabug: 40021348] {CVE-2026-89595}
entry: Fix seccomp bypass after ptrace with TSYNC (Jinjie Ruan) [Orabug: 40021399] {CVE-2026-89603}
openvswitch: Fix CT limit teardown use-after-free (Yuqi Xu) [Orabug: 40020919] {CVE-2026-89488}
net: openvswitch: fix kernel-doc warnings in internal headers (Ilya Maximets)
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() (Norbert Szetei) [Orabug: 40034343] {CVE-2026-90049}
net: skbuff: don't touch shared zerocopy state in skb_tx_error() (Norbert Szetei) [Orabug: 40020575] {CVE-2026-80977}
platform/chrome: sensorhub: Fix dropped timestamp events and log spam (Tzung-Bi Shih)
udf: Fix i_lenExtents truncation on 32-bit kernels (Zhan Xusheng)
timer: Keep debugobjects state consistent in migrate_timer_list() (Thomas Gleixner)
taskstats: fix cpumask parsing cutting off the last character (Bradley Morgan)
smack: fix cred UAF in smack_file_send_sigiotask() (Jann Horn)
signal: avoid shared siginfo namespace rewrites (Bradley Morgan) [Orabug: 40072687] {CVE-2026-93222}
tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (Myeonghun Pak) [Orabug: 40020406] {CVE-2026-80930}
w1: ds28e17: reject an oversize length on an I2C block read (Maoyi Xie)
vsock/virtio: flush works in dependency order (Chengfeng Ye) [Orabug: 40020418] {CVE-2026-80932}
wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (Runyu Xiao)
wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (Abdun Nihaal) [Orabug: 40020441] {CVE-2026-80941}
wifi: rtl818x: initialize eeprom_93cx6 struct to zero (Stanislaw Gruszka)
wifi: mwifiex: Detach sync cmd buffer on interrupted wait (Fabio Estevam) [Orabug: 40020450] {CVE-2026-80944}
wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (Abdun Nihaal) [Orabug: 40020473] {CVE-2026-80949}
i3c: master: svc: bound IBI payload to the requested max_payload_len (Maoyi Xie)
i3c: master: Fix info leak and UAF in device unregister path (Adrian Hunter)
dm-switch: use WRITE_ONCE() in switch_region_table_write() (Xu Wang)
dm-stats: fix a crash if allocation of per-cpu data fails (Mikulas Patocka) [Orabug: 40020503] {CVE-2026-80963}
arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() (Nathan Chancellor)
PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (Naman Jain)
ALSA: virmidi: Check card index validity at probe (Takashi Iwai) [Orabug: 40020510] {CVE-2026-80964}
ALSA: serial-u16550: Check card index validity at probe (Takashi Iwai) [Orabug: 40020518] {CVE-2026-80965}
ALSA: portman2x4: Check card index validity at probe (Takashi Iwai)
ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (Runyu Xiao) [Orabug: 40020528] {CVE-2026-80967}
ALSA: mts64: Check card index validity at probe (Takashi Iwai)
ALSA: mpu401: Check card index validity at probe (Takashi Iwai) [Orabug: 40020541] {CVE-2026-80969}
ALSA: bcd2000: clear the URB pointers on disconnect (Baul Lee) [Orabug: 40020546] {CVE-2026-80971}
ALSA: aloop: Check card index validity at probe (Takashi Iwai) [Orabug: 40020553] {CVE-2026-80972}
ALSA: 6fire: bound the MIDI event length from the device (Baul Lee) [Orabug: 40020557] {CVE-2026-80973}
seg6: reset IP6CB after IPv6 decapsulation (Zhiling Zou) [Orabug: 40020568] {CVE-2026-80976}
net: cap advertised IP tunnel headroom (Zhiling Zou) [Orabug: 40020586] {CVE-2026-80978}
net/smc: fix socket refcount leak in smc_switch_conns() (Hidayath Khan)
net: ntb_netdev: Count packets dropped on RX refill failure (Koichiro Den)
net: ntb_netdev: Avoid double-accounting netif_rx() drops (Koichiro Den)
NTB: ntb_transport: Reject oversized TX buffers (Koichiro Den) [Orabug: 40020617] {CVE-2026-80987}
NTB: ntb_transport: Fail TX enqueue when the QP link is down (Koichiro Den) [Orabug: 40020622] {CVE-2026-80988}
NTB: ntb_transport: Recycle TX entries before client callbacks (Koichiro Den)
net: openvswitch: fix nf_connlabels leak in ovs_ct_init (Ruoyu Wang)
net: openvswitch: fix flow mask use-after-free on flow deletion (Ilya Maximets) [Orabug: 40020651] {CVE-2026-80994}
net: tun: bound receive headroom (Asim Viladi Oglu Manizada) [Orabug: 40020672,40035523] {CVE-2026-81000}
net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (Fabio Porcedda)
slip: fix use-after-free in sl_sync() (Aleksandr Khromov) [Orabug: 40020676] {CVE-2026-81001}
xdp: fix zero-copy frame layout (Weiming Shi) [Orabug: 40020684] {CVE-2026-81002}
net/iucv: filter frames in afiucv_hs_rcv() by ingress device (Alexandra Winter)
ipmi: si: Fix NULL pointer dereference after failed registration (Seiji Nishikawa) [Orabug: 40020693] {CVE-2026-81005}
ipmi: ipmb: validate write message length (Yousef Alhouseen)
interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (Kuan-Wei Chiu) [Orabug: 40020706] {CVE-2026-81008}
platform/chrome: sensorhub: Bound the EC-reported sensor number (Bryam Vargas) [Orabug: 40020728] {CVE-2026-81017}
mmc: via-sdmmc: stop card-detect handling on probe failure (Fan Wu) [Orabug: 40020746] {CVE-2026-89440}
platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (Hyeongjun An) [Orabug: 40020760] {CVE-2026-89444}
iommu/vt-d: Fix no_iommu to disable platform opt-in (Kevin Tian)
PCI/proc: Use file_ns_capable() when checking config space read access (Krzysztof Wilczynski) [Orabug: 40072623] {CVE-2026-93206}
PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (Krzysztof Wilczynski)
PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (Krzysztof Wilczynski)
PCI: meson: Fix GPIO state while requesting PERST# (Ronald Claveau)
PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (Mohamad Raizudeen)
s390/dasd: Propagate partial completion length across ERP recovery (Stefan Haberland)
s390/dasd: Guard sysfs discipline callbacks against unallocated private data (Stefan Haberland)
s390/dasd: Do not complete a failed ESE read as successful (Stefan Haberland)
power: supply: max17040: synchronize work cancellation on suspend (Jianing Li) [Orabug: 40020807] {CVE-2026-89461}
power: supply: ucs1002: fix use-after-free on remove (Fan Wu)
power: supply: twl4030_charger: cancel workers via devm (Maoyi Xie)
power: supply: lp8727: fix use-after-free in lp8727_release_irq() (Fan Wu) [Orabug: 40020838] {CVE-2026-89469}
power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (Jameson Thies)
power: supply: cros_usbpd-charger: bound the EC-reported port count (Bryam Vargas)
power: supply: bq256xx: drain usb_work before freeing the charger (Fan Wu)
power: supply: bq24257: fix use-after-free on remove (Fan Wu)
sctp: fix stream->outcnt underflow on duplicate RECONF responses (Jun Yang) [Orabug: 40020865] {CVE-2026-89476}
sctp: distinguish sequence zero from wildcard in reconf lookup (Jun Yang)
sctp: fix NULL deref on untransmitted RECONF completion (Weiming Shi) [Orabug: 40020869] {CVE-2026-89477}
sctp: drop a chunk if its transport was removed (Hyunwoo Kim) [Orabug: 40020874] {CVE-2026-89478}
sctp: stop processing a packet once its association is deleted (Hyunwoo Kim) [Orabug: 40020879] {CVE-2026-89479}
nvme-tcp: reject a read that transferred too few bytes (Yehyeong Lee) [Orabug: 40020884] {CVE-2026-89480}
nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (Yehyeong Lee) [Orabug: 40020895] {CVE-2026-89482}
nvme: zero the discard fallback page (Yehyeong Lee) [Orabug: 40020900] {CVE-2026-89483}
nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path (Ewan D. Milne)
lockd: pin next file across nlm_inspect_file lock-drop (Michael Bommarito) [Orabug: 40020908] {CVE-2026-89485}
hwmon: (max6621) fix temperature clamp range (Cong Nguyen)
hwmon: (max6621) fix negative temperature offset and crit readings (Cong Nguyen)
openvswitch: only skb_tx_error() a packet we are about to drop (Norbert Szetei) [Orabug: 40020915] {CVE-2026-89487}
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall (Ali Ahmet Memis)
ocfs2: fix readdir position truncation on 32-bit kernels (Zhan Xusheng) [Orabug: 40020927] {CVE-2026-89490}
ocfs2: cluster: fix o2hb_dependent_users leak on pin failure (Joseph Qi)
ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item (Joseph Qi)
ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() (Joseph Qi) [Orabug: 40020931] {CVE-2026-89491}
ocfs2: validate rl_used against rl_count in refcount block validator (Ibrahim Hashimov) [Orabug: 40020941] {CVE-2026-89493}
ocfs2: validate lengths in dlm_mig_lockres_handler (Bryam Vargas) [Orabug: 40020946] {CVE-2026-89494}
ocfs2: bound namelen in dlm_migrate_request_handler (Bryam Vargas) [Orabug: 40020953] {CVE-2026-89495}
ocfs2: always run deallocs on copy-on-write completion (Dmitry Antipov) [Orabug: 40020958] {CVE-2026-89496}
orangefs: skip leading spaces before parsing client debug masks (Zhiling Zou)
orangefs: fix double-free of trailer_buf on readdir copy failure (Yifei Gao)
regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (Xu Wang)
regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (Xu Wang)
RDMA/ucma: Lock the handler in ucma_set_ib_path() (Norbert Szetei) [Orabug: 40020989] {CVE-2026-89508}
RDMA/cxgb4: Cancel reg_work before freeing device on remove (Fan Wu) [Orabug: 40020994] {CVE-2026-89510}
qede: Fix NULL pointer dereference in TPA fragment processing (Vaibhav Nagare) [Orabug: 40020998] {CVE-2026-89511}
remoteproc: scp: Fix device reference leak on failed lookup (Johan Hovold)
rpmsg: glink: smem: order FIFO read after availability check (Chunkai Deng)
staging: media: tegra-video: vi: fix probe failure on skipped last port (Hao-Qun Huang)
wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (Doruk Tan Ozturk) [Orabug: 40021029] {CVE-2026-89524}
udf: reject VAT indexes equal to the entry count (David Lee) [Orabug: 40021035] {CVE-2026-89525}
svcrdma: Fix pcl_for_each_segment for empty chunks (Chris Mason) [Orabug: 40021067] {CVE-2026-89532}
svcrdma: Fix offset arithmetic in read_chunk_range (Chris Mason) [Orabug: 40021070] {CVE-2026-89533}
SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (Chuck Lever) [Orabug: 40021086] {CVE-2026-89538}
sunrpc: init gssp_lock before publishing proc entry (Chris Mason) [Orabug: 40021094] {CVE-2026-89540}
SUNRPC: harden gss_unwrap_resp_priv length checks (Chris Mason) [Orabug: 40021099] {CVE-2026-89541}
SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat (Chris Mason)
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (Chris Mason) [Orabug: 40021115] {CVE-2026-89542}
SUNRPC: always drain cache_cleaner before destroying a cache_detail (Jeff Layton) [Orabug: 40021154] {CVE-2026-89548}
sunrpc: route to a populated pool in svc_pool_for_cpu() (Jeff Layton) [Orabug: 40021159] {CVE-2026-89549}
SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (Chris Mason) [Orabug: 40021168] {CVE-2026-89551}
mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction (Harshit Varu) [Orabug: 40021181] {CVE-2026-89554}
mpls: reload header after pskb_may_pull() (Qing Ming) [Orabug: 40021185] {CVE-2026-89555}
md: do overflow check for sb->bblog_shift in super_1_load() (Coly Li) [Orabug: 40021190] {CVE-2026-89557}
libnvdimm/labels: Prevent integer overflow in __nd_label_validate() (Bryam Vargas) [Orabug: 40021198] {CVE-2026-89559}
ipv6: use RCU iterator to dump route exceptions (Yuyang Huang) [Orabug: 40072700] {CVE-2026-93226}
ip6_gre: fix hardware header length for NBMA tunnels (Zhiling Zou) [Orabug: 40021214] {CVE-2026-89562}
ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() (Zhiling Zou) [Orabug: 40021220] {CVE-2026-89563}
Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (Guangshuo Li)
Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (Guangshuo Li)
Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (Valentin Kindschi)
Bluetooth: RFCOMM: serialize security confirmation handling (Chengfeng Ye) [Orabug: 40021245] {CVE-2026-89569}
Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (Gongwei Li)
Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (Guangshuo Li)
cpufreq: schedutil: Fix rate limit overflow (Sh_Def)
dm array: reject an array block whose value size is not the caller's (Bryam Vargas) [Orabug: 40021260] {CVE-2026-89573}
dm raid1: reserve space for NUL-terminator in build_constructor_string() (Ilya Krutskih) [Orabug: 40021275] {CVE-2026-89575}
dm-era: fix shadowed superblock leak on take-snap failure (Liyouhong) [Orabug: 40021282] {CVE-2026-89576}
bnx2x: fix double free in bnx2x_init_firmware() error path (Jiangshan Yi) [Orabug: 40021303] {CVE-2026-89582}
Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (Christoph Zwerschke)
Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (Christoph Zwerschke)
auxdisplay: charlcd: cancel backlight work on registration failure (Hongyan Xu) [Orabug: 40021314] {CVE-2026-89585}
ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes (Niklas Cassel) [Orabug: 40021320] {CVE-2026-89586}
alpha: marvel: Fix lock ordering in init_io7_irqs() (Matt Turner)
alpha: marvel: Fix irq_set_status_flags to use correct IRQ number (Matt Turner)
alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() (Krzysztof Wilczynski)
hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device (Ivaylo Dimitrov)
fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (Ang Tien Sung)
forcedeth: fix off-by-one when saving/restoring non-PCI config space (Marek Czernohous) [Orabug: 40021354] {CVE-2026-89596}
fbdev: uvesafb: unregister connector callback on init failure (Myeonghun Pak)
fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (Florian Fuchs)
fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (Runyu Xiao)
fat: restore original value when fat_ent_write failed (Yemu Lu)
ecryptfs: show filename encryption options (Chenyichong)
ecryptfs: release message context on send failure (Chenyichong)
ecryptfs: reject too-small tag 70 packets (Chenyichong) [Orabug: 40021413] {CVE-2026-89606}
ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet (Ji'An Zhou) [Orabug: 40021420] {CVE-2026-89607}
ecryptfs: pass packet set buffer size to parser (Chenyichong) [Orabug: 40021428] {CVE-2026-89608}
ecryptfs: hold msg ctx list lock when cleaning daemon queue (Chenyichong)
ecryptfs: fix tag 11 packet exact-fit size check (Chenyichong)
eCryptfs: bound the packet-length peek to the user buffer (Pengpeng Hou)
fs/ntfs3: bound page_lcns[] index by the log record (Konstantin Komarov)
fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() (Samuel Page)
fs/ntfs3: validate dirty page table on log replay (Xiang Mei)
HID: mcp2221: validate report size in mcp2221_raw_event() (Jiangshan Yi)
HID: sensor: custom: Fix field sysfs group cleanup on failure (Haoxiang Li) [Orabug: 40021498] {CVE-2026-89626}
HID: roccat: free buffered reports when destroying device (Xu Rao) [Orabug: 40021502] {CVE-2026-89627}
HID: picolcd: clamp eeprom debugfs read to bytes actually received (Ibrahim Hashimov) [Orabug: 40021507] {CVE-2026-89628}
audit: avoid dropping live tree ref on fsnotify rule autoremove (Jeremy Jean) [Orabug: 40021557] {CVE-2026-89643}
ceph: bound xattr value length in __build_xattrs() (Michael Bommarito) [Orabug: 40021580] {CVE-2026-89649}
ceph: bound num_export_targets array for mds info v2/v3 (Michael Bommarito) [Orabug: 40021586] {CVE-2026-89650}
ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode (Jeremy Jean) [Orabug: 40021598] {CVE-2026-89653}
ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock (Xiubo Li) [Orabug: 40021606] {CVE-2026-89655}
libceph: reject buckets with mismatched CRUSH ids (Jeremy Jean) [Orabug: 40021610] {CVE-2026-89656}
NFSD: Prevent lock owner use-after-free during client teardown (Chuck Lever) [Orabug: 40021632] {CVE-2026-89662}
nfsd: revoke copy-notify stateids before dropping their reference (Jeff Layton) [Orabug: 40021636] {CVE-2026-89663}
nfsd: reject reclaim LOCK after RECLAIM_COMPLETE (Jeff Layton)
nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (Robbie Ko) [Orabug: 40021644] {CVE-2026-89665}
nfsd: initialize copy-notify stateid before publishing it (Jeff Layton) [Orabug: 40021657] {CVE-2026-89669}
nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (Jeff Layton) [Orabug: 40021672] {CVE-2026-89673}
nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (Jeff Layton) [Orabug: 40021678] {CVE-2026-89674}
nfsd: fix version mismatch loops in nfsd_acl_init_request() (Jeff Layton)
nfsd: fix cpntf publish race in nfs4_init_cp_state (Chris Mason) [Orabug: 40021707] {CVE-2026-89684}
nfsd: check client ownership when cancelling a copy-notify stateid (Jeff Layton) [Orabug: 40021732] {CVE-2026-89694}
nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (Jeff Layton) [Orabug: 40021741] {CVE-2026-89696}
nfsd: add filehandle match check to nfsd4_delegreturn() (Jeff Layton)
nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (Jeff Layton) [Orabug: 40021745] {CVE-2026-89697}
nfsd: validate symlink target length in NFSv4 CREATE (Jeff Layton) [Orabug: 40021751] {CVE-2026-89699}
nfsd: sample writeback error cursor before async COPY loop (Chuck Lever) [Orabug: 40021767] {CVE-2026-89704}
nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types (Jeff Layton)
nfsd: Reset write verifier when async COPY writeback fails (Chuck Lever) [Orabug: 40021772] {CVE-2026-89706}
NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (Junrui Luo) [Orabug: 40021788] {CVE-2026-89710}
NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check (Mike Snitzer) [Orabug: 40021791] {CVE-2026-89711}
NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (Michael Bommarito) [Orabug: 40021796] {CVE-2026-89712}
NFSD: Fix off-by-one in DRC bucket pruning limit (Chuck Lever)
NFSD: Encode only the status in NFS-ACL v2 GETACL error replies (Chuck Lever)
ubifs: fix out-of-bounds read in signature length check (Ibrahim Hashimov)
of: fix out-of-bounds read in of_alias_scan() stem parser (Abdurrahman Hussain) [Orabug: 40072646] {CVE-2026-93213}
nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation (Ryusuke Konishi)
media: vicodec: fix out-of-bounds write in FWHT encoder (Junrui Luo)
media: cec: stm32: prevent out-of-bounds write on RX overflow (Weigang He)
lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (Vincent Mailhol) [Orabug: 40021841] {CVE-2026-89726}
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (Xingrui Li) [Orabug: 40021848] {CVE-2026-89729}
fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (Daisuke Matsuda)
usb: gadget: f_fs: Prevent deadlock during ep0 read loop (Neill Kapron)
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (Jeffin Philip)
usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (Yun Zhou) [Orabug: 40072652] {CVE-2026-93214}
usb: gadget: snps_udc_plat: clean up PHY on probe deferral (Myeonghun Pak)
usb: gadget: u_audio: Fix use-after-free on sound card disconnect (Sonali Pradhan)
USB: phy: fsl-usb: fix missing static keywords (Johan Hovold)
usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (Francesco Lavra)
staging: greybus: hid: fix SET_REPORT return value (Hao-Qun Huang)
Revert 'media: v4l2-dev: fix error handling in __video_register_device()' (Hans Verkuil) [Orabug: 40021886] {CVE-2026-89741}
rapidio: mport_cdev: fix use-after-free in dma_req_free() (James Kim)
powerpc/powermac: fix OF node refcount (Bartosz Golaszewski)
tracing: Fix crash passing ERR_PTR to kthread_stop() (Sh_Def) [Orabug: 40021906] {CVE-2026-89749}
x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() (Kiryl Shutsemau)
tools/compiler: match glibc 2.42 definition of attribute_const (Joy H.J. Lee)
mm: memcg: stop reclaim when a limit update is superseded (Zhangguopeng) [Orabug: 40021914] {CVE-2026-89752}
mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() (Breno Leitao) [Orabug: 40021918] {CVE-2026-89753}
include/linux/list.h: mark list_add and __list_add as __always_inline (Jordan R Abrahams-Whitehead)
timers/itimer: Zero-init old itimerval before copy to userspace (Jeremy Jean) [Orabug: 40021963] {CVE-2026-89765}
clocksource/drivers/timer-sun4i: Advertise a real minimum delta (Felix Yan) [Orabug: 40072669] {CVE-2026-93219}
alpha: don't leak hardware-fabricated FP exception bits to user space (Matt Turner)
alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally (Matt Turner)
ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970446] {CVE-2026-23191}

[5.15.0-325.220.5]

octeontx2-pf: fix SQB pointer leak on init failure (Dawei Feng) [Orabug: 39951718]
batman-adv: Remove stale reason member from batadv_tp_vars (Vijayendra Suman) [Orabug: 39966037]
Revert 'octeontx2-pf: Fix leak of SQ timestamp buffer on teardown' (Vijayendra Suman) [Orabug: 39967930]
tcp: fix potential race in tcp_v6_syn_recv_sock() (Eric Dumazet) [Orabug: 39331624,40035386] {CVE-2026-43198}
RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (Bjoern Doebel) [Orabug: 39886288,39886588,40035390] {CVE-2026-74268,CVE-2026-74378}
tcp: clear sock_ops cb flags before force-closing a child socket (Sechang Lim) [Orabug: 39886288,39886588,40035388] {CVE-2026-74268,CVE-2026-74378}
net: af_key: zero aligned sockaddr tail in PF_KEY exports (Zhengchuan Liang) [Orabug: 39331155,40035384] {CVE-2026-43088}
uek-rpm: clean up failed kernel installation (Sagar Sagar) [Orabug: 39735711]
vhost-scsi: use kvzalloc for vq array allocation (Dongli Zhang) [Orabug: 40015348]
x86/cpuid: move X86_FEATURE_NT_GOOD to word 2 (Aruna Ramakrishna) [Orabug: 39966615]
bpf: Fix combination of jit blinding and pointers to bpf subprogs. (Alexei Starovoitov) [Orabug: 39965261]
net: Work around Marvell NIC TX stalls (Wengang Wang) [Orabug: 39766660]
uek: kabi: update x86_64 kABI files for new symbols (Saeed Mirzamohammadi) [Orabug: 39940294]
Revert 'net/mlx5: Add poll-eq API to be used by ULP's' (Praveen Kumar Kannoju) [Orabug: 39890590]

[5.15.0-325.220.4]

LTS version: v5.15.220 (Vijayendra Suman)
usb: usbfs: fix use-after-free of usb_device in usbdev_release() (Miguel Penaranda) [Orabug: 39982120] {CVE-2026-80824}
USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (Shuangpeng Bai)
USB: serial: spcp8x5: drop broken carrier detect support (Johan Hovold)
USB: serial: option: fix slab OOB read in interrupt URB callback (Jiale Yao) [Orabug: 39982131] {CVE-2026-80827}
ALSA: usb-audio: Complete cleanup after system-resume errors (Will Porter) [Orabug: 39982135] {CVE-2026-80828}
ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (Marouane El Moufid) [Orabug: 39982139] {CVE-2026-80829}
usb: core: Strengthen error handling in hub_hub_status() (Griffin Kroah-Hartman)
usb: core: Add lock to usb_wakeup_notification() (Griffin Kroah-Hartman) [Orabug: 39982143] {CVE-2026-80830}
KVM: s390: vsie: zero stale crypto bits (Christian Borntraeger)
crypto: qce - Remove unsafe/deprecated algorithms (Bartosz Golaszewski)
crypto: mxs-dcp - fix source scatterlist length access (Thorsten Blum)
crypto: qce - fix CCM AAD buffer underallocation (Md Sadre Alam)
crypto: atmel-tdes - use scatterlist length before DMA mapping (Thorsten Blum)
mm/swap: reject swapon() on filesystem-level encrypted files (Eric Biggers)
ipv6: seg6: clear IPv4 control block on IPIP decapsulation (Kyle Zeng) [Orabug: 39982172] {CVE-2026-80840}
net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (Norbert Szetei) [Orabug: 39982180] {CVE-2026-80842}
xfrm: fix xfrm_state_construct() auth-trunc leak (Zihan Xi) [Orabug: 39982183] {CVE-2026-80843}
xfrm: ah6: validate routing header segments_left (Asim Viladi Oglu Manizada) [Orabug: 39982187,40035522] {CVE-2026-80844}
xfrm: drop ESP-in-TCP packets with no ingress device (Zhiling Zou)
xfrm: espintcp: fix UAF during close (Sabrina Dubroca)
usb: gadget: f_tcm: keep port count until LUN teardown completes (Shuangpeng Bai) [Orabug: 39982217] {CVE-2026-80854}
usb: usbtest: disable dynamic ID support (Aleksandr Nogikh)
fuse: fix invalidate lock leak on open O_TRUNC DAX failure (Baokun Li) [Orabug: 39982221] {CVE-2026-80855}
fuse: fix invalidate lock leak on setattr writeback failure (Baokun Li) [Orabug: 39982224] {CVE-2026-80856}
xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (Lucas De Marchi)
xhci: dbgtty: Fix unregister on tty_register_driver() failure (Lucas De Marchi) [Orabug: 40010372] {CVE-2026-80923}
accessibility: speakup: unregister tty ldisc on later init failures (Haoxiang Li)
fpga: dfl: fme: add error handling (Griffin Kroah-Hartman)
HID: input: read battery capacity from its actual report offset (Jose Villasenor Montfort)
HID: ft260: fix stack-use-after-return write in I2C read race (Raman Varabets)
HID: ft260: validate i2c input report length (Michael Zaidman)
HID: ft260: missed NACK from busy device (Michael Zaidman)
HID: ft260: wake up device from power saving mode (Michael Zaidman)
HID: ft260: skip unexpected HID input reports (Michael Zaidman)
HID: ft260: improve i2c large reads performance (Michael Zaidman)
HID: ft260: improve i2c write performance (Michael Zaidman)
HID: ft260: fix i2c probing for hwmon devices (Michael Zaidman)
nvmet-tcp: bound SGL data length before allocating command buffers (Ibrahim Hashimov) [Orabug: 39982006] {CVE-2026-80789}
nvme: rename CDR/MORE/DNR to NVME_STATUS_* (Weiwen Hu)
HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (Jose Villasenor Montfort) [Orabug: 39981987] {CVE-2026-80783}
nfc: nci: add data_len bound checks to activation parameter extractors (Bryam Vargas)
nilfs2: reject invalid block index in GC ioctl (Ryusuke Konishi)
nilfs2: correct return value kernel-doc descriptions for ioctl functions (Ryusuke Konishi)
ext4: propagate errors from fast commit range replay (Guanghui Yang)
kcov: fix data corruption and race conditions on PREEMPT_RT (Tetsuo Handa) [Orabug: 40010347] {CVE-2026-80916}
kcov: replace local_irq_save() with a local_lock_t (Sebastian Andrzej Siewior)
ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (Eric Dumazet) [Orabug: 39885781] {CVE-2026-72323}
ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (Ji'An Zhou) [Orabug: 40017137] {CVE-2026-53242}
ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (Mehul Rao) [Orabug: 39343942] {CVE-2026-43437}
ASoC: tegra: Fix Master Volume Control (Jonathan Hunter)
ALSA: pcm: fix wait_time calculations (Oswald Buddenhagen)
Revert 'smb: client: use kvzalloc() for megabyte buffer in simple fallocate' (Sasha Levin)
Revert 'mtd: maps: vmu-flash: fix fault in unaligned fixup' (Sasha Levin) [Orabug: 39967936]
selinux: switch two allocations to use kzalloc_objs() (Stephen Smalley)
smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk(). (Kuniyuki Iwashima)
Revert 'PM: sleep: Use complete() in device_pm_sleep_init()' (Sasha Levin)
bpf: Fix use-after-free in offloaded map/prog info fill (Jiayuan Chen) [Orabug: 39622047] {CVE-2026-53089}
KVM: arm64: Prevent access to vCPU events before init (Oliver Upton) [Orabug: 38601896] {CVE-2025-40102}
can: j1939: make j1939_sk_bind() fail if device is no longer registered (Tetsuo Handa)
can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (Tetsuo Handa)
can: j1939: implement NETDEV_UNREGISTER notification handler (Tetsuo Handa) [Orabug: 38494827] {CVE-2025-39925}
jfs: add check read-only before txBeginAnon() call (Vasiliy Kovalev)
jfs: add check read-only before truncation in jfs_truncate_nolock() (Vasiliy Kovalev)
bpf: Remove tst_run from lwt_seg6local_prog_ops. (Sebastian Andrzej Siewior) [Orabug: 37074553] {CVE-2024-46754}
ipvs: reload ip header after head reallocation (Florian Westphal) [Orabug: 39884703] {CVE-2026-68476}
io_uring/io-wq: fix worker accounting when canceling creation callbacks (Vishnu Razdan)
ext4: don't enable DAX on new encrypted files (Eric Biggers) [Orabug: 39982070] {CVE-2026-80806}
RDMA/rxe: Fix OOB in free_rd_atomic_resources() (Peiyang He) [Orabug: 39982237] {CVE-2026-80863}
LTS version: v5.15.219 (Vijayendra Suman)
inet: frags: strip GSO state from fragments before reassembly (Xinyang Ge) [Orabug: 39972531,39974835] {CVE-2026-80590}
LTS version: v5.15.218 (Vijayendra Suman)
Revert 'ALSA: aoa: Use guard() for mutex locks' (Sasha Levin)
HID: hyperv: validate initial device info bounds (Michael Bommarito) [Orabug: 39981945] {CVE-2026-80765}
HID: sensor: custom: Fix use-after-free in enable_sensor (Haoxiang Li) [Orabug: 39981954] {CVE-2026-80767}
HID: core: fix number/pointer type confusion on long items (Jann Horn) [Orabug: 40010353] {CVE-2026-80918}
can: isotp: fix timer drain order, wakeup handling and tx_gen ordering (Oliver Hartkopp) [Orabug: 39982403] {CVE-2026-80889}
can: use skb hash instead of private variable in headroom (Oliver Hartkopp)
mptcp: pm: fix data race in add_addr timer callback (Luoqing)
mptcp: pm: ADD_ADDR rtx: free sk if last (Matthieu Baerts) [Orabug: 39460461] {CVE-2026-46170}
mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (Matthieu Baerts) [Orabug: 39460401] {CVE-2026-46158}
mptcp: pm: ADD_ADDR rtx: allow ID 0 (Matthieu Baerts)
Input: atkbd - skip deactivate for HONOR ZQC-P (Donglin Lyu)
Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard (Cryolitia Pukngae)
s390/vfio_ccw: Free all memory if cp_init() fails (Eric Farman)
iomap: adjust read range correctly for non-block-aligned positions (Joanne Koong) [Orabug: 38847820] {CVE-2025-68794}
xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (Xiang Mei) [Orabug: 39839297] {CVE-2026-64581}
HID: core: fix OOB read of field->usage in hid_set_field() (Baul Lee) [Orabug: 39981979] {CVE-2026-80781}
HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (Lee Jones)
HID: magicmouse: do not keep a stale msc->input if no input is claimed (Jose Villasenor Montfort) [Orabug: 39981983] {CVE-2026-80782}
ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses (Dawid WroBel)
mptcp: avoid combining some incoming suboptions (Matthieu Baerts) [Orabug: 39973016] {CVE-2026-80587}
s390/vfio_ccw: Implement a crw lock (Eric Farman)
s390/vfio_ccw: Selectively expand io_mutex (Eric Farman)
s390/vfio_ccw: Ensure index for read/write regions are within range (Eric Farman)
nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations (Greg Kroah-Hartman) [Orabug: 39982002] {CVE-2026-80788}
nvmet-fc: fix invalid free in LS IOD error path (Honghui Jiang) [Orabug: 39982010] {CVE-2026-80790}
ipv6: fix use-after-free in ip6_finish_output2() (Luxiao Xu) [Orabug: 39982017] {CVE-2026-80792}
ipv4: reject undersized MTUs in ip_do_fragment() (Yong Wang) [Orabug: 39982021] {CVE-2026-80793}
drm/amdgpu: check ASPM on the dGPU host link (Yang Wang)
libceph: fix OOB read in decode_watchers() via missing bounds check (Pavitra Jha) [Orabug: 39972906] {CVE-2026-80557}
nfc: nci: free destination parameters when closing a connection (Linmao Li)
nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (Samuel Page)
nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (Samuel Page)
nfc: st21nfca: validate ATR_REQ length against the received frame (Doruk Tan Ozturk)
nfc: pn533: purge fragmented skbs during cleanup (Xu Rao)
nfc: llcp: reject PDUs shorter than the LLCP header (Doruk Tan Ozturk)
nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (Muhammad Bilal)
nfc: llcp: bound the connect_sn TLV walk to the skb (Doruk Tan Ozturk)
nfc: microread: validate target discovery payload lengths (Pengpeng Hou)
nfc: fdp: bound the device-reported read length and fix an skb leak (Bryam Vargas)
nfc: digital: clamp SENSF_RES length to the destination buffer (Doruk Tan Ozturk)
xfs: bounds-check buffer log item's dirty bitmap (Ibrahim Hashimov) [Orabug: 39972835] {CVE-2026-80536}
s390/vfio_ccw: Cancel existing workqueues (Eric Farman)
inet: frags: publish queues before arming timer (Zhiling Zou) [Orabug: 39919187] {CVE-2026-74662}
packet: synchronize pressure clearing with ring reconfiguration (Zihan Xi) [Orabug: 39919201] {CVE-2026-74666}
net/sched: reject overly deep qdisc hierarchies (Zijie Huang) [Orabug: 39919191] {CVE-2026-74663}
packet: use consistent hard_header_len in TX_RING send path (Qihang) [Orabug: 39919209] {CVE-2026-74668}
packet: use consistent hard_header_len in non-ring send paths (Qihang) [Orabug: 39917533] {CVE-2026-74582}
serial: amba-pl011: synchronize DMA teardown (Fan Wu) [Orabug: 39973443] {CVE-2026-80737}
NTB: ntb_netdev: Preserve RX queue depth on allocation failure (Koichiro Den) [Orabug: 39919082] {CVE-2026-74626}
perf/core: Fix group leader use-after-free after sibling detach (Aditya Chillara) [Orabug: 39919114] {CVE-2026-74637}
perf: Fix dangling cgroup pointer in cpuctx (Levi Yun)
perf: Fix cgroup state vs ERROR (Peter Zijlstra)
perf/core: Fix child_total_time_enabled accounting bug at task exit (Levi Yun)
misc: fastrpc: Remove buffer from list prior to unmap operation (Ekansh Gupta)
misc: fastrpc: Rework fastrpc_req_munmap (Abel Vesa)
misc: fastrpc: separate fastrpc device from channel context (Srinivas Kandagatla)
mm/huge_memory: fix huge_zero_pfn race (Lorenzo Stoakes) [Orabug: 39919100] {CVE-2026-74632}
gpio: ml-ioh: use raw_spinlock_t for the register lock (Junjie Cao)
xfs: validate attr entry pointer before field access (Hongling Zeng) [Orabug: 39982067] {CVE-2026-80805}
ext4: clear error before retrying inode xattr space fallback (Guanghui Yang)
ext4: stop retrying saturated xattr cache entries (Matthias Goergens) [Orabug: 39982077] {CVE-2026-80808}
null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows (Rik van Riel)
ocfs2: fix missing metadata reservation for large xattrs (Ian Bridges) [Orabug: 39982081] {CVE-2026-80809}
ALSA: dummy: Check card index validity at probe (Takashi Iwai) [Orabug: 39982087] {CVE-2026-80812}
rndis_host: add overflow check in rndis_rx_fixup() (Griffin Kroah-Hartman) [Orabug: 39982092] {CVE-2026-80814}
Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (Ali Ahmet Memis) [Orabug: 39982102] {CVE-2026-80819}
PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems (Steffen Persvold) [Orabug: 40010350] {CVE-2026-80917}

[5.15.0-325.217.3]

LTS version: v5.15.217 (Vijayendra Suman)
ring-buffer: Use current_context for safe per-CPU buffer swap (Tengda Wu) [Orabug: 39919010] {CVE-2026-74601}
ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (Steven Rostedt)
jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)
drm/virtio: Unlock reservations on dma_resv_reserve_fences() error (Dmitry Osipenko)
drm/vmwgfx: Reserve fence slots on buffer objects in cotables (Zack Rusin)
udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() (Robert Mader)
binfmt_misc: use exe_file_deny_write_access() for the interpreter clone (Christian Brauner) [Orabug: 39974107] {CVE-2026-74486}
net/x25: fix use-after-free of the socket by its timers (Baul Lee) [Orabug: 39919087] {CVE-2026-74628}
net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (Siddharth Vadapalli)
af_packet: Don't send zero-byte data in tpacket_snd(). (Eric Dumazet) [Orabug: 39973457] {CVE-2026-80742}
ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (Rosen Penev)
net: packet: fix wrong transport_header when sending VLAN-tagged frame (Wei Fang) [Orabug: 39982352] {CVE-2026-80906}
netfilter: ipset: fix list type element drift bug (Florian Westphal)
netfilter: flowtable: publish GC-visible tuple last (Jeremy Jean) [Orabug: 39972761] {CVE-2026-74746}
netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path (Alexey Velichayshiy) [Orabug: 39973466] {CVE-2026-80744}
netfilter: ipset: fix refcount race between list:set GC and swap (Xiang Mei) [Orabug: 39972772] {CVE-2026-74748}
crypto: ccm - Set rfc4309 maxauthsize from child (Herbert Xu)
arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 (Jonathan Hunter)
net: smc: fix splice entry lifetime imbalance in smc_rx_splice (Li Daming)
net/smc: rdma write inline if qp has sufficient inline space (Guangguan Wang)
net: atlantic: free stranded TX buffers on ring deinit (Yangyu Chen) [Orabug: 39919072] {CVE-2026-74623}
net/sched: act_ct: fix sk_buff leak when the header checks reject a packet (Hyunjung Ko) [Orabug: 39919065] {CVE-2026-74621}
openvswitch: move key and ovs_cb update out of handle_fragments (Xin Long)
net: sched: use skb_ip_totlen and iph_totlen (Xin Long)
openvswitch: use skb_ip_totlen in conntrack (Xin Long)
net: add a couple of helpers for iph tot_len (Xin Long)
mm/ptdump: always stabilise against page table freeing using init_mm (Lorenzo Stoakes) [Orabug: 39919004] {CVE-2026-74599}
sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (Tejun Heo) [Orabug: 39918989] {CVE-2026-74594}
drm/amd/pm: fix torn gpu metrics reads (Yang Wang)
ice: wait for reset completion in ice_resume() (Aaron Ma)
jiffies: Define secs_to_jiffies() (Easwar Hariharan)
can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (Marc Kleine-Budde)
i2c: iproc: reset bus after timeout if START_BUSY is stuck (Jonas Gorski)
i2c: bcm-iproc: remove printout on handled timeouts (Wolfram Sang)
i2c: imx: Fix slave registration race and error handling (Liem) [Orabug: 39973286] {CVE-2026-80678}
binfmt_misc: restore write access when removing an entry (Christian Brauner) [Orabug: 39886902] {CVE-2026-74487}
fs: don't block write during exec on pre-content watched files (Amir Goldstein)
fsnotify: opt-in for permission events at file open time (Amir Goldstein)
ice: fix memory leak in ice_lbtest_prepare_rings() (Dawei Feng)
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write (Ibrahim Hashimov) [Orabug: 39886847] {CVE-2026-74470}
scsi: scsi_debug: Rename zone type constants (Damien Le Moal)
scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics() (Damien Le Moal)
scsi: sd: sd_zbc: Introduce struct zoned_disk_info (Bart Van Assche)
scsi: sd: sd_zbc: Use logical blocks as unit when querying zones (Damien Le Moal)
scsi: sd: sd_zbc: Improve source code documentation (Bart Van Assche)
net: pktgen: fix proc entry use-after-free (Chengfeng Ye) [Orabug: 39886875] {CVE-2026-74479}
net: pktgen: fix code style (WARNING: Block comments) (Peter Seiderer)
igc: remove napi_synchronize() in igc_down() (David Carlier) [Orabug: 39973387] {CVE-2026-80715}
wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (Maoyi Xie) [Orabug: 39884956] {CVE-2026-72070}
ksmbd: reject repeated SMB2 NEGOTIATE requests (Namjae Jeon)
ksmbd: conn lock to serialize smb2 negotiate (Namjae Jeon)
mm/vmstat: fold stranded per-cpu node stats when a node comes online (Gregory Price)
ksmbd: validate minimum PDU size for transform requests (Namjae Jeon)
smb/server: fix minimum SMB2 PDU size (Chenxiaosong)
smb/server: fix minimum SMB1 PDU size (Chenxiaosong)
ksmbd: rename smb2_get_msg to smb_get_msg (Namjae Jeon)
super: fix emergency thaw deadlock on frozen block devices (Christian Brauner) [Orabug: 39859442] {CVE-2026-68132}
ftrace: Add global mutex to serialize trace_parser access (Tengda Wu) [Orabug: 39859492] {CVE-2026-68146}
net/sched: serialize qdisc_rtab_list against concurrent get/put (Aldo Ariel Panzardo) [Orabug: 39859462] {CVE-2026-68138}
ksmbd: defer destroy_previous_session() until after NTLM authentication (James Montgomery)
libceph: fix two unsafe bare decodes in decode_lockers() (Pavitra Jha) [Orabug: 39852162] {CVE-2026-68082}
ceph: fix hanging __ceph_get_caps() with stale mds_wanted (Max Kellermann) [Orabug: 39972807] {CVE-2026-80527}
ceph: print cluster fsid and client global_id in all debug logs (Xiubo Li)
ceph: rename _to_client() to _to_fs_client() (Xiubo Li)
libceph: add doutc and *_client debug macros support (Xiubo Li)
libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (Xiang Mei) [Orabug: 39859534] {CVE-2026-68159}
libceph: Amend checking to fix make W=1 build breakage (Andy Shevchenko)
ceph: avoid fs reclaim while using current->journal_info (Max Kellermann) [Orabug: 39972810] {CVE-2026-80528}
sctp: avoid auth_enable sysctl UAF during netns teardown (Zhiling Zou) [Orabug: 39859549] {CVE-2026-68162}
mptcp: decrement subflows counter on failed passive join (Chenguang Zhao)
mptcp: fix subflow accounting on close (Paolo Abeni)
mptcp: cleanup MPJ subflow list handling (Paolo Abeni)
serial: sc16is7xx: implement gpio get_direction() callback (Hugo Villeneuve)
serial: sc16is7xx: fix regression with GPIO configuration (Hugo Villeneuve)
serial: sc16is7xx: remove obsolete out_thread label (Hugo Villeneuve)
serial: sc16is7xx: Fill in rs485_supported (Ilpo Jarvinen)
sc16is7xx: Properly resume TX after stop (Tomasz Mon)
wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 (Liangcheng Wang)
wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) (Gokul Sivakumar)
serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (Jiangshan Yi) [Orabug: 39868565] {CVE-2026-68434}
serial: 8250_mid: Remove unneeded test for ->setup() presence (Andy Shevchenko)
wifi: brcmfmac: drain bus_reset work on device removal (Fan Wu) [Orabug: 39843565] {CVE-2026-64586}
ALSA: seq: close a re-opened queue timer in the destructor (Norbert Szetei) [Orabug: 39859660] {CVE-2026-68202}
media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (Mirela Rabulea) [Orabug: 39859672] {CVE-2026-68205}
media: v4l: async: Set owner for async sub-devices (Sakari Ailus)
wifi: ath6kl: fix use-after-free in aggr_reset_state() (Daniel Hodges) [Orabug: 39859648] {CVE-2026-68198}
media: imx219: Fix maximum frame length in lines (Sakari Ailus)
media: i2c: imx219: Rename VTS to FRM_LENGTH (Jai Luthra)
media: i2c: imx219: Correct the minimum vblanking value (David Plowman)
media: i2c: imx219: Drop IMX219_VTS_* macros (Laurent Pinchart)
media: marvell-cam: fix missing pci_disable_device() on remove (Guangshuo Li)
drm/i915/hdcp: require monotonically increasing seq_num_v (Jani Nikula)
drm/i915/hdcp: check streams[] bounds before overflow (Jani Nikula) [Orabug: 39859828] {CVE-2026-68253}
drm/i915/vrr: require valid min/max vfreq for VRR (Jani Nikula) [Orabug: 39859832] {CVE-2026-68254}
media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (David Carlier)
drm/virtio: bound EDID block reads to the response buffer (Bryam Vargas) [Orabug: 39859836] {CVE-2026-68255}
drm/virtio: Return proper error codes instead of -1 (Dmitry Osipenko)
drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT (Timur Kristof)
drm/tegra: fbdev: Remove offset into framebuffer memory (Thomas Zimmermann)
drm/displayid: fix Tiled Display Topology ID size (Jani Nikula)
drm/virtio: use uninterruptible resv lock for plane updates (Deepanshu Kartikey) [Orabug: 39754773] {CVE-2026-64098}
dma-buf/drivers: make reserving a shared slot mandatory v4 (Christian Konig)
drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (Ashutosh Desai) [Orabug: 39859888] {CVE-2026-68277}
drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (Ashutosh Desai) [Orabug: 39859896] {CVE-2026-68279}
usb: gadget: f_tcm: synchronize delayed set_alt with teardown (Cen Zhang) [Orabug: 39860172] {CVE-2026-68367}
drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Ashutosh Desai) [Orabug: 39859892] {CVE-2026-68278}
fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (Reinette Chatre) [Orabug: 39884753] {CVE-2026-72015}
octeontx2-pf: fix SQB pointer leak on init failure (Dawei Feng) [Orabug: 39951718]
net: ipa: fix SMEM state handle leaks in SMP2P init (Haoxiang Li)
espintcp: use sk_msg_free_partial to fix partial send (Sabrina Dubroca)
bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() (Breno Leitao)
bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c (Breno Leitao)
bootconfig: do not put quotes on cmdline items unless necessary (Rasmus Villemoes)
net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (Bryam Vargas) [Orabug: 39884827] {CVE-2026-72035}
net/sched: taprio: avoid calling child->ops->dequeue(child) twice (Vladimir Oltean)
gpio: tegra: do not call pinctrl for GPIO direction (Runyu Xiao) [Orabug: 39884922] {CVE-2026-72063}
treewide: rename pinctrl_gpio_direction_output_new() (Bartosz Golaszewski)
octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Junrui Luo) [Orabug: 39884855] {CVE-2026-72045}
net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (Maoyi Xie) [Orabug: 39884875] {CVE-2026-72051}
net: mana: Validate the packet length reported by the NIC (Dexuan Cui) [Orabug: 39884929] {CVE-2026-72065}
net/sched: act_ct: preserve tc_skb_cb across defragmentation (Zihan Xi) [Orabug: 39884899] {CVE-2026-72057}
net: ixp4xx_hss: fix duplicate HDLC netdev allocation (Haoxiang Li)
net: ipip: require CAP_NET_ADMIN in the device netns for changelink (Maoyi Xie) [Orabug: 39884883] {CVE-2026-72053}
net: Add helper function to parse netlink msg of ip_tunnel_encap (Liu Jian)
locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Thomas Gleixner)
mmc: vub300: fix use-after-free on probe failure (Guangshuo Li) [Orabug: 39884968] {CVE-2026-72073}
mmc: vub300: rename probe error labels (Johan Hovold)
mmc: vub300: fix use-after-free on disconnect (Johan Hovold)
Input: ims-pcu - fix firmware leak in async update (Dmitry Torokhov)
firmware_loader: introduce __free() cleanup hanler (Dmitry Torokhov)
dm-verity: make error counter atomic (Mikulas Patocka) [Orabug: 39885054] {CVE-2026-72096}
dm-integrity: don't increment hash_offset twice (Mikulas Patocka) [Orabug: 39885064] {CVE-2026-72099}
scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() (Abdun Nihaal) [Orabug: 39885038] {CVE-2026-72087}
ovl: use linked upper dentry in copy-up tmpfile (Souvik Banerjee)
bpf,fork: wipe ->bpf_storage before bailouts that access it (Jann Horn) [Orabug: 39885094] {CVE-2026-72110}
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect (Michael Bommarito) [Orabug: 39887152] {CVE-2026-74575}
thunderbolt: Remove XDomain from the bus without holding tb->lock (Mika Westerberg)
thunderbolt: Remove service debugfs entries during unregister (Mika Westerberg)
thunderbolt: Keep XDomain reference during the lifetime of a service (Mika Westerberg) [Orabug: 40073914] {CVE-2026-97509}
thunderbolt: Update property.c function documentation (Alan Borzeszkowski)
thunderbolt: Remove usage of the deprecated ida_simple_xx() API (Christophe Jaillet)
can: esd_usb: kill anchored URBs before freeing netdevs (Fan Wu) [Orabug: 39843561] {CVE-2026-64585}
can/esd_usb2: Rename esd_usb2.c to esd_usb.c (Frank Jungclaus)
i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Vincent Jardin) [Orabug: 39885191] {CVE-2026-72142}
i2c: imx: separate atomic, dma and non-dma use case (Stefan Eichenberger)
ksmbd: fix integer overflow in set_file_allocation_info() (Ibrahim Hashimov)
tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (Jarkko Sakkinen) [Orabug: 39885221] {CVE-2026-72152}
smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Fredric Cover)
taskstats: retain dead thread stats in TGID queries (Yiyang Chen)
taskstats: fill_stats_for_tgid: use for_each_thread() (Oleg Nesterov)
dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK (Frank Li)
dmaengine: dw-edma: Detach the private data and chip info structures (Frank Li)
dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip (Frank Li)
mtd: spi-nor: swp: Improve locking user experience (Miquel Raynal) [Orabug: 39885230] {CVE-2026-72155}
mtd: spi-nor: Fix spi_nor_try_unlock_all() (Michael Walle)
net: thunderbolt: Fix frags[] overflow by bounding frame_count (Maoyi Xie)
mtd: maps: vmu-flash: fix fault in unaligned fixup (Florian Fuchs)
9p: skip nlink update in cacheless mode to fix WARN_ON (Breno Leitao) [Orabug: 39885290] {CVE-2026-72170}
ntfs3: validate split-point offset in indx_insert_into_buffer (Michael Bommarito)
fs/ntfs3: Undo critial modificatins to keep directory consistency (Konstantin Komarov)
fs/ntfs3: Make ntfs_update_mftmirr return void (Pavel Skripkin)
selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (Tristan Madani) [Orabug: 39885551] {CVE-2026-72242}
lsm: infrastructure management of the sock security (Casey Schaufler)
lsm: use default hook return value in call_int_hook() (Ondrej Mosnacek)
remoteproc: qcom: Fix leak when custom dump_segments addition fails (Wasim Nazir)
remoteproc: qcom: pas: Adjust the phys addr wrt the mem region (Yogesh Lal)
remoteproc: qcom: fix sparse warnings (Mukesh Ojha)
remoteproc: qcom: replace kstrdup with kstrndup (Mukesh Ojha)
netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [Orabug: 39885581] {CVE-2026-72252}
netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal)
netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal)
netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal)
netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal)
netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal)
netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (Pablo Neira Ayuso) [Orabug: 39885585] {CVE-2026-72253}
netfilter: nf_conntrack_sip: remove net variable shadowing (Florian Westphal)
netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal)
netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal)
ASoC: mediatek: mt8192: Check runtime resume during probe (Cassio Gabriel)
ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable (Tang Bin)
ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb (AngeloGioacchino Del Regno)
ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() (AngeloGioacchino Del Regno)
ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() (AngeloGioacchino Del Regno)
netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (Haoze Xie) [Orabug: 39885591] {CVE-2026-72255}
ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
net: dst: add four helpers to annotate data-races around dst->dev (Eric Dumazet)
net: dst: annotate data-races around dst->output (Eric Dumazet)
net: dst: annotate data-races around dst->input (Eric Dumazet)
tcp: convert to dev_net_rcu() (Eric Dumazet)
ASoC: mediatek: mt8183: Check runtime resume during probe (Cassio Gabriel)
octeontx2-vf: clear stale mailbox IRQ state before request_irq() (Runyu Xiao)
octeontx2-pf: clear stale mailbox IRQ state before request_irq() (Runyu Xiao)
octeontx2: Annotate mmio regions as __iomem (Subbaraya Sundeep)
octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG (Geetha Sowjanya)
VDUSE: avoid leaking information to userspace (Jason Wang) [Orabug: 39885723] {CVE-2026-72305}
vduse: take out allocations from vduse_dev_alloc_coherent (Eugenio Perez)
vduse: remove unused vaddr parameter of vduse_domain_free_coherent (Eugenio Perez)
vduse: Use fixed 4KB bounce pages for non-4KB page size (Sheng Zhao)
mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (Xu Wang)
tipc: restrict socket queue dumps in enqueue tracepoints (Li Xiasong) [Orabug: 39885709] {CVE-2026-72299}
fbcon: Use correct type for vc_resize() return value (Jiacheng Yu)
fbcon: Rename struct fbcon_ops to struct fbcon_par (Thomas Zimmermann)
rxrpc: serialize kernel accept preallocation with socket teardown (Li Daming)
serial: max310x: implement gpio_chip::get_direction() (Tapio Reijonen)
serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) (Hugo Villeneuve)
ALSA: hda: Fix cached processing coefficient verbs (Xu Rao)
audit: fix recursive locking deadlock in audit_dupe_exe() (Ricardo Robaina) [Orabug: 39859311] {CVE-2026-68096}
audit: use 'unsigned int' instead of 'unsigned' (Ricardo Robaina)
audit: widen ino fields to u64 (Jeff Layton)
VFS/audit: introduce kern_path_parent() for audit (Neil Brown)
ALSA: hda: conexant: Remove mic bias threshold override (Zhang Heng)
Input: mms114 - reject an oversized device packet size (Bryam Vargas) [Orabug: 39785798] {CVE-2026-64270}
i2c: davinci: Unregister cpufreq notifier on probe failure (Haoxiang Li)
Input: mms114 - fix touch indexing for MMS134S and MMS136 (Dmitry Torokhov) [Orabug: 39785807] {CVE-2026-64272}
fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (Sebastian Alba Vives)
dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning (Mikhail Gavrilov)
udmabuf: Do not create malformed scatterlists (Jason Gunthorpe)
bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (Matt Bobrowski) [Orabug: 39760896] {CVE-2026-64192}
iommu/amd: Don't split flush for amd_iommu_domain_flush_all() (Weinan Liu)
mm: do file ownership checks with the proper mount idmap (Pedro Falcato) [Orabug: 39785859] {CVE-2026-64294}
net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (Xiang Mei)
xfs: check v5 superblock features early (Christoph Hellwig)
xfs: fix ilock leak on error in xfs_dq_get_next_id (Long Li) [Orabug: 39972825] {CVE-2026-80534}
drm/amdgpu: Fix UVD decode image min size calculation (David Rosca) [Orabug: 39972847] {CVE-2026-80540}
drm/amdgpu: Implement insert_end for VCE 3 (David Rosca)
drm/amdgpu: Reject UVD message with dimensions above 4096 (David Rosca) [Orabug: 39982361] {CVE-2026-80908}
drm/amdgpu: validate GEM_CREATE domain combinations (Candice Li) [Orabug: 39972852] {CVE-2026-80541}
drm/amdgpu: Reject UVD message with invalid number of h265 refs (David Rosca) [Orabug: 39982365] {CVE-2026-80909}
s390/vfio_ccw: Fix out of bounds check on CCW array (Eric Farman)
drm/radeon: fix autosuspend cleanup during teardown (Guangshuo Li)
mmc: sdhci: make tuning_err a signed int (Haibo Chen)
mmc: sdhci: unmap the bounce buffer before device release (Myeonghun Pak)
mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (Zhan Xusheng)
libceph: tolerate addrvecs with multiple entries of the same type (Kefu Chai)
ceph: fix MDS random selection readiness predicate (Yiming Zhu)
libceph: Avoid using invalid osd indices from primary_temp (Raphael Zimmer) [Orabug: 39972915] {CVE-2026-80558}
Input: sur40 - fix V4L error path cleanup (Dmitry Torokhov)
Input: sur40 - fix input device registration ordering (Dmitry Torokhov)
openrisc: signal: do not restore privileged SR bits on sigreturn (Ali Ahmet Memis)
ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() (Josh Poimboeuf)
libceph: fix multiple unsafe decodes in decode_locker() (Pavitra Jha) [Orabug: 39972927] {CVE-2026-80561}
crypto: qce - fix error path in devm_qce_register_algs (Thorsten Blum)
Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (Dmitry Torokhov)
Input: synaptics-rmi4 - block s_input when F54 queue is busy (Dmitry Torokhov)
Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (Bryam Vargas) [Orabug: 39972955] {CVE-2026-80569}
Input: synaptics-rmi4 - zero report size on F54 work error (Dmitry Torokhov) [Orabug: 39972960] {CVE-2026-80570}
powerpc/pseries: lparcfg - fix kbuf[] underflow (George Wilson)
Input: iforce - validate input packet lengths (Pengpeng Hou)
Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (Zhefu Zhang)
Input: psxpad-spi - set driver data before use (Linmao Li)
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (Richard Davies) [Orabug: 39972975] {CVE-2026-80574}
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (Dmitry Torokhov) [Orabug: 39973486] {CVE-2026-80754}
powerpc/pseries: pci - logic bug (George Wilson)
ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (Dawid WroBel)
ASoC: cs4265: sort the register default table (Peter Ujfalusi)
s390/qeth: validate user buffer length in SNMP and ARP query ioctls (Hidayath Khan)
mptcp: options: reset DSS fields in case of unexpected size (Matthieu Baerts) [Orabug: 39973013] {CVE-2026-80586}
selinux: do not cancel a policy conversion that never started (Bryam Vargas) [Orabug: 39973494] {CVE-2026-80756}
selinux: reject a class permission count below its inherited common (Bryam Vargas) [Orabug: 39973498] {CVE-2026-80757}
selinux: require every boolean value to be defined (Bryam Vargas) [Orabug: 39982381] {CVE-2026-80913}
ipvs: separate destination availability state (Yizhou Zhao)
fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (Zhan Xusheng) [Orabug: 39918992] {CVE-2026-74595}
media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (Jiasheng Jiang)
media: mtk-vcodec: potential null pointer deference in SCP (Fullway Wang)
f2fs: fix UAF issue in f2fs_merge_page_bio() (Chao Yu)
LTS version: v5.15.216 (Vijayendra Suman)
thunderbolt: Bound the DROM dual link port number before indexing sw->ports (Bryam Vargas) [Orabug: 39918961] {CVE-2026-74585}
sctp: clear new_transport when removing a peer (Qing Ming) [Orabug: 39918965] {CVE-2026-74586}
sctp: fix use-after-free of cached ASCONF chunk (Yuxiang Yang) [Orabug: 39918969] {CVE-2026-74587}
sctp: keep chunk->transport in step with the list it is queued on (Baul Lee) [Orabug: 39918973] {CVE-2026-74588}
scsi: scsi_debug: Negate wrapped memcmp() result (Xu Rao)
bpf, sockmap: Fix sk_redir use-after-free in send verdict (Chengfeng Ye) [Orabug: 39918977] {CVE-2026-74589}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() (Zhiling Zou) [Orabug: 39918996] {CVE-2026-74597}
ipv6: fix Route Information option length validation (Yuejie Shi) [Orabug: 39919000] {CVE-2026-74598}
Revert 'thermal/drivers/hwmon: Cleanup coding style a bit' (Rafael J. Wysocki) [Orabug: 39919019] {CVE-2026-74604}
tipc: read le->link under the node lock in tipc_node_link_down() (Jun Yang) [Orabug: 39919032] {CVE-2026-74609}
vhost: reset the vring metadata cache on vring reconfiguration (Jun Yang) [Orabug: 39917525] {CVE-2026-74580}
vsock/virtio: avoid refilling the RX queue after teardown (Weiming Shi) [Orabug: 39919042] {CVE-2026-74613}
vsock/virtio: read virtqueues under worker locks (Weiming Shi) [Orabug: 39919046] {CVE-2026-74614}
vxlan: do not arm the ageing timer on a device that is down (Baul Lee) [Orabug: 39919049] {CVE-2026-74615}
xdp: reject clones that overrun skb_shared_info tailroom (Zhiling Zou) [Orabug: 39919053] {CVE-2026-74616}
net/sched: act_gact, act_police: range check the fallback control action (Hyunjung Ko) [Orabug: 39919061] {CVE-2026-74620}
net: atlantic: free RX pages of consumed but not refilled buffers (Yangyu Chen) [Orabug: 39919068] {CVE-2026-74622}
netfilter: bridge: release template ct on non-IP path (Zhiling Zou) [Orabug: 39919078] {CVE-2026-74625}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev (Kyle Zeng) [Orabug: 39919092] {CVE-2026-74630}
fbdev: bitblit: bound-check glyph index in bit_cursor() (Rik van Riel) [Orabug: 39919107] {CVE-2026-74635}
tracing: Fix race between update_event_fields and, event_define_fields (Michael Wu) [Orabug: 39919111] {CVE-2026-74636}
ALSA: usx2y: bound the hwdep mmap fault offset (Baul Lee) [Orabug: 39919124] {CVE-2026-74641}
misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (Eddie Lin)
misc: fastrpc: fix channel ctx ref leak when session alloc fails (Anandu Krishnan E)
staging: rtl8723bs: validate monitor transmit frame lengths (Mariano Baragiola) [Orabug: 39919138] {CVE-2026-74648}
staging: rtl8723bs: fix missing shared-key auth challenge length check (Panagiotis Petrakopoulos) [Orabug: 39919142] {CVE-2026-74649}
staging: rtl8723bs: fix OOB read in WMM_param_handler() (Muhammad Bilal) [Orabug: 39919146] {CVE-2026-74650}
staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (Muhammad Bilal) [Orabug: 39919150] {CVE-2026-74651}
serial: 8250_dma: Clear stale RX state on shutdown (Cunhao Lu) [Orabug: 39919159] {CVE-2026-74654}
ipv4: fix use-after-free in fib_nhc_update_mtu() (Chengfeng Ye) [Orabug: 39919165] {CVE-2026-74656}
ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops (Zihan Xi) [Orabug: 39919169] {CVE-2026-74657}
fscrypt: Replace mk_users keyring with simple list (Eric Biggers)
pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP (Claudiu Beznea)
futex: Prevent robust futex exit race some more (Keno Fischer) [Orabug: 39919174] {CVE-2026-74658}
Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev (Luiz Augusto von Dentz)
Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (Marco Elver) [Orabug: 39786570] {CVE-2026-64434}
Input: evdev - fix information leak in evdev_pass_values() (Dmitry Torokhov) [Orabug: 39919227] {CVE-2026-74673}
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (Joshua Rogers) [Orabug: 39919232] {CVE-2026-74675}
vt: add permission check for KDSKBMETA ioctl (Joshua Rogers) [Orabug: 39919236] {CVE-2026-74676}
net: bridge: mrp: fix uninitialised bytes on the wire (Baul Lee)
netfilter: ebt_nflog: pin the NFLOG backend (Chengfeng Ye) [Orabug: 39919181] {CVE-2026-74660}
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Qihang) [Orabug: 39973427] {CVE-2026-80731}
net: octeontx2-pf: Fix UB in shift operation (Sergey V. Frolov)
net: openvswitch: reallocate update replies for mismatched IDs (Zhiling Zou) [Orabug: 39919195] {CVE-2026-74664}
net/packet: reset the MAC header on the packet-socket transmit path (Doruk Tan Ozturk) [Orabug: 39919205] {CVE-2026-74667}
ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Kyle Zeng) [Orabug: 39919213] {CVE-2026-74669}
ipvs: properly update the overload flag on dest edit (Julian Anastasov)
ipvs: add totalconns for dest (Julian Anastasov)
ima: fix out-of-bounds read in xattr_verify() (Lincoln Wallace) [Orabug: 39919219] {CVE-2026-74671}
usb: gadget: f_ncm: Use unsigned int for ndp_index (Sonali Pradhan) [Orabug: 39919247] {CVE-2026-74679}
usb: cdnsp: fix incorrect endian conversions for APB timeout register (Pawel Laszczak)
thunderbolt: icm: Preserve USB4 proxy data-valid bit (Xu Rao)
usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (Aleksandr Nogikh) [Orabug: 39919251] {CVE-2026-74680}
ALSA: usb-audio: fix OOB write on Type II inbound URBs (Baul Lee) [Orabug: 39919256] {CVE-2026-74682}
Input: evdev - sanitize event type index when fetching event masks (Dmitry Torokhov) [Orabug: 39919260] {CVE-2026-74683}
spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (Larisa Grigore)
hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (Wilken Gottwalt)
tls: don't abort the connection on signal-interrupted sends (Maximilian Immanuel Brandtner)
sctp: clear control chunk transport if it is being removed (Xin Long) [Orabug: 39919275] {CVE-2026-74688}
ata: pata_sl82c105: fix bridge revision use-after-free (Hongyan Xu)
net: thunderbolt: Tear down DMA paths before stopping the rings (Fan Xinran)
net: qrtr: ns: Raise lookup limit to 128 (Lukasz Patron)
net/smc: fix TOCTOU race between smc_listen_out() and listener close (Sidraya Jayagond)
net: remove WARN_ON_ONCE() from sk_mc_loop() (Eric Dumazet) [Orabug: 39973435] {CVE-2026-80733}
net: prestera: validate firmware header length (Pengpeng Hou)
net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (Henry Martin)
tcp: fix TFO max_qlen accounting across reuseport migration (Jiayuan Chen) [Orabug: 39919306] {CVE-2026-74696}
sctp: fix addip_serial increment on ASCONF_ACK allocation failure (Luoqing)
bnxt_en: Fix PTP PPS setting bug (Keegan Freyhof)
bnxt_en: Disable EOP for TPA on all chips to prevent data corruption (Michael Chan) [Orabug: 39919309] {CVE-2026-74697}
bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (Michael Chan)
selftests/ftrace: refactor eprobes test to fix argument checks (Martin Kaiser)
selftests/ftrace: Add test case for GRP/ only input (Linyu Yuan)
net/openvswitch: check Ethernet header length in key_extract() (Cen Zhang) [Orabug: 39919320] {CVE-2026-74701}
net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter (Toke Hoiland-Jorgensen) [Orabug: 39919330] {CVE-2026-74704}
udp: fix potential use-after-free in tunnel segmentation (Luoxuanqiang) [Orabug: 39919334] {CVE-2026-74705}
vhost/vdpa: reject overflowing PA map page counts on 32-bit (Yousef Alhouseen)
counter: microchip-tcb-capture: Fix DT channel validation (Babanpreet Singh)
net/mlx5: fw_tracer, return NULL on create error (Michael Guralnik) [Orabug: 39919359] {CVE-2026-74717}
net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete (Jiawen Liu)
net/sched: cls_route: fix fastmap use-after-free on filter (Jamal Hadi Salim) [Orabug: 39917538] {CVE-2026-74583}
net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() (Mahanta Jambigi)
bpf: Preserve pointer state for commuted arithmetic (Yiyang Chen) [Orabug: 39919369] {CVE-2026-74720} ...

Обновленные пакеты

Oracle Linux 8

Oracle Linux aarch64

bpftool

5.15.0-325.221.6.3.el8uek

kernel-uek

5.15.0-325.221.6.3.el8uek

kernel-uek-container

5.15.0-325.221.6.3.el8uek

kernel-uek-container-debug

5.15.0-325.221.6.3.el8uek

kernel-uek-core

5.15.0-325.221.6.3.el8uek

kernel-uek-debug

5.15.0-325.221.6.3.el8uek

kernel-uek-debug-core

5.15.0-325.221.6.3.el8uek

kernel-uek-debug-devel

5.15.0-325.221.6.3.el8uek

kernel-uek-debug-modules

5.15.0-325.221.6.3.el8uek

kernel-uek-debug-modules-extra

5.15.0-325.221.6.3.el8uek

kernel-uek-devel

5.15.0-325.221.6.3.el8uek

kernel-uek-doc

5.15.0-325.221.6.3.el8uek

kernel-uek-modules

5.15.0-325.221.6.3.el8uek

kernel-uek-modules-extra

5.15.0-325.221.6.3.el8uek

Oracle Linux x86_64

bpftool

5.15.0-325.221.6.3.el8uek

kernel-uek

5.15.0-325.221.6.3.el8uek

kernel-uek-container

5.15.0-325.221.6.3.el8uek

kernel-uek-container-debug

5.15.0-325.221.6.3.el8uek

kernel-uek-core

5.15.0-325.221.6.3.el8uek

kernel-uek-debug

5.15.0-325.221.6.3.el8uek

kernel-uek-debug-core

5.15.0-325.221.6.3.el8uek

kernel-uek-debug-devel

5.15.0-325.221.6.3.el8uek

kernel-uek-debug-modules

5.15.0-325.221.6.3.el8uek

kernel-uek-debug-modules-extra

5.15.0-325.221.6.3.el8uek

kernel-uek-devel

5.15.0-325.221.6.3.el8uek

kernel-uek-doc

5.15.0-325.221.6.3.el8uek

kernel-uek-modules

5.15.0-325.221.6.3.el8uek

kernel-uek-modules-extra

5.15.0-325.221.6.3.el8uek

Oracle Linux 9

Oracle Linux aarch64

bpftool

5.15.0-325.221.6.3.el9uek

kernel-uek

5.15.0-325.221.6.3.el9uek

kernel-uek-container

5.15.0-325.221.6.3.el9uek

kernel-uek-container-debug

5.15.0-325.221.6.3.el9uek

kernel-uek-core

5.15.0-325.221.6.3.el9uek

kernel-uek-debug

5.15.0-325.221.6.3.el9uek

kernel-uek-debug-core

5.15.0-325.221.6.3.el9uek

kernel-uek-debug-devel

5.15.0-325.221.6.3.el9uek

kernel-uek-debug-modules

5.15.0-325.221.6.3.el9uek

kernel-uek-debug-modules-extra

5.15.0-325.221.6.3.el9uek

kernel-uek-devel

5.15.0-325.221.6.3.el9uek

kernel-uek-doc

5.15.0-325.221.6.3.el9uek

kernel-uek-modules

5.15.0-325.221.6.3.el9uek

kernel-uek-modules-extra

5.15.0-325.221.6.3.el9uek

kernel-uek64k

5.15.0-325.221.6.3.el9uek

kernel-uek64k-core

5.15.0-325.221.6.3.el9uek

kernel-uek64k-devel

5.15.0-325.221.6.3.el9uek

kernel-uek64k-modules

5.15.0-325.221.6.3.el9uek

kernel-uek64k-modules-extra

5.15.0-325.221.6.3.el9uek

Oracle Linux x86_64

bpftool

5.15.0-325.221.6.3.el9uek

kernel-uek

5.15.0-325.221.6.3.el9uek

kernel-uek-container

5.15.0-325.221.6.3.el9uek

kernel-uek-container-debug

5.15.0-325.221.6.3.el9uek

kernel-uek-core

5.15.0-325.221.6.3.el9uek

kernel-uek-debug

5.15.0-325.221.6.3.el9uek

kernel-uek-debug-core

5.15.0-325.221.6.3.el9uek

kernel-uek-debug-devel

5.15.0-325.221.6.3.el9uek

kernel-uek-debug-modules

5.15.0-325.221.6.3.el9uek

kernel-uek-debug-modules-extra

5.15.0-325.221.6.3.el9uek

kernel-uek-devel

5.15.0-325.221.6.3.el9uek

kernel-uek-doc

5.15.0-325.221.6.3.el9uek

kernel-uek-modules

5.15.0-325.221.6.3.el9uek

kernel-uek-modules-extra

5.15.0-325.221.6.3.el9uek

Связанные CVE

CVE-2026-98260

Ссылки на источники

Связанные уязвимости

CVE-2026-98260

CVSS3: 7.8

ubuntu

21 день назад

In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after de_thread() A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posix_cputimers. The task is looked up by that PID. When a non-leader thread exec()s, de_thread() changes which task owns that PID. pid_task(timer->it.cpu.pid, PIDTYPE_PID) then returns NULL, but the node is still queued on tsk, which is alive. timer_lock_sighand() takes a failed lookup to mean that the node is already dequeued, so it has nothing to undo. begin_new_exec() calls posix_cpu_timers_exit(me) right after exec_task_namespaces() and that removes the leftover node, so the state normally stays invisible. But bprm->point_of_no_return is set before de_thread(), so if unshare_files(), set_mm_exe_file(), exec_mmap() or exec_task_namespaces() fails, the task dies before it gets there. exit_itimers() then frees the k_itimer...